Function at 0x44d2a0
Capabilities:
Create directory
Get file attributes
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4f14ff
push eax
mov eax, 0x1984
mov dword fs:[0], esp
call fcn.004ded50
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0xe4]
mov dword [esp + 0x2c], ebp
cmp eax, ebx
mov dword [esp + 0x70], ebx
je 0x44de6b
lea ecx, [eax + 0x20]
lea edx, [esp + 0x58]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov eax, dword [esp + 0x58]
cmp eax, 2
je 0x44d2fc
cmp eax, 3
jne 0x44de6b
mov eax, dword [ebp + 0xe4]
lea edx, [esp + 0x74]
push edx
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 0x7c]
mov eax, dword [esp + 0x74]
cmp eax, 0x31
je 0x44d322
cmp eax, 0x10
jne 0x44de6b
cmp dword [esp + 0x19a4], 0x131
jne 0x44d338
cmp eax, 0x10
jne 0x44de6b
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xd60]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd64]
push eax
push 0x9d42
call fcn.00432b50
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x54c]
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, dword [0x50d0e0]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0xe4]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x19a0], ebx
call fcn.0041eba0
mov eax, dword [0x50d0e0]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push 0x5c
push eax
mov byte [esp + 0x19a4], 1
mov edi, dword [eax - 8]
call fcn.004dec29
add esp, 8
cmp eax, ebx
jne 0x44d3bf
or eax, 0xffffffff
jmp 0x44d3c5
sub eax, dword [esp + 0x20]
sar eax, 1
sub edi, eax
lea ecx, [esp + 0x24]
dec edi
push edi
push ecx
lea ecx, [esp + 0x28]
call fcn.004071a0
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
mov byte [esp + 0x199c], 2
je 0x44d42b
cmp dword [ecx - 0xc], ebx
jge 0x44d3fd
mov edx, dword [0x50d0e4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x44d402
cmp dword [eax - 0xc], ebx
jge 0x44d412
mov edx, dword [eax - 8]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004021f0
jmp 0x44d42b
lea ecx, [esp + 0x14]
call fcn.00402350
mov esi, dword [esi]
mov dword [esp + 0x14], esi
lea eax, [esi - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x24]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d462
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d462
mov edx, dword [esp + 0x24]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x1c]
call fcn.004071a0
mov ecx, dword [esp + 0x1c]
push str.._mv
push ecx
mov byte [esp + 0x19a4], 3
call fcn.004dec69
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
test eax, eax
jne 0x44d5c8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov eax, dword [edx - 8]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00407030
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
mov byte [esp + 0x199c], 4
je 0x44d507
cmp dword [ecx - 0xc], ebx
jge 0x44d4d9
mov edx, dword [0x50d0e4]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x44d4de
cmp dword [eax - 0xc], ebx
jge 0x44d4ee
mov ecx, dword [eax - 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.004021f0
jmp 0x44d507
lea ecx, [esp + 0x1c]
call fcn.00402350
mov esi, dword [esi]
mov dword [esp + 0x1c], esi
lea eax, [esi - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x24]
mov ecx, dword [0x50d0e4]
mov byte [esp + 0x199c], 3
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x44d53e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d53e
mov eax, dword [esp + 0x24]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x14]
cmp dword [eax - 8], ebx
je 0x44d57a
cmp dword [eax - 0xc], ebx
jl 0x44d557
lea ecx, [esp + 0x14]
call fcn.00402350
jmp 0x44d57a
mov ecx, 0x5209fc
test ecx, ecx
jne 0x44d564
xor eax, eax
jmp 0x44d56b
push 0x5209fc
call edi
push 0x5209fc
push eax
lea ecx, [esp + 0x1c]
call fcn.004021f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
je 0x44d5c8
cmp dword [eax - 0xc], ebx
jge 0x44d598
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x44d59d
cmp dword [ecx - 0xc], ebx
jge 0x44d5ad
mov edx, dword [ecx - 8]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.004021f0
jmp 0x44d5c8
lea ecx, [esp + 0x14]
call fcn.00402350
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
push 0x2e
push eax
call fcn.004dec29
add esp, 8
cmp eax, ebx
je 0x44d6c5
sub eax, dword [esp + 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x44d6c5
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00407030
mov eax, dword [esp + 0x14]
mov byte [esp + 0x199c], 5
cmp dword [eax - 8], ebx
je 0x44d645
cmp dword [eax - 0xc], ebx
jl 0x44d61e
lea ecx, [esp + 0x14]
call fcn.00402350
jmp 0x44d641
mov edx, 0x5209fc
test edx, edx
jne 0x44d62b
xor eax, eax
jmp 0x44d632
push 0x5209fc
call edi
push 0x5209fc
push eax
lea ecx, [esp + 0x1c]
call fcn.004021f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x44d693
cmp dword [eax - 0xc], ebx
jge 0x44d65f
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
jne 0x44d664
cmp dword [ecx - 0xc], ebx
jge 0x44d674
mov eax, dword [ecx - 8]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004021f0
jmp 0x44d68f
lea ecx, [esp + 0x14]
call fcn.00402350
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x18]
mov eax, dword [0x50d0e4]
lea edx, [ecx - 0xc]
cmp edx, eax
mov byte [esp + 0x199c], 3
je 0x44d6c5
lea eax, [ecx - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d6c5
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [0x52585c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [0x52585c]
cmp dword [edx - 8], ebx
je 0x44d6e5
test al, 0x10
jne 0x44d80a
push 0x5209fc
push SysReAllocStringLen
lea ecx, [esp + 0x1588]
call fcn.004c4470
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x950]
push 0x208
rep stosd dword es:[edi], eax
lea eax, [esp + 0x954]
mov bl, 6
push eax
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea ecx, [esp + 0x1590]
mov byte [esp + 0x19ac], bl
call fcn.004c44c0
lea ecx, [esp + 0x950]
test ecx, ecx
jne 0x44d746
xor eax, eax
jmp 0x44d754
lea edx, [esp + 0x950]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x950]
push ecx
push eax
mov ecx, 0x52585c
call fcn.004021f0
lea edx, [esp + 0x30]
push 1
push edx
mov ecx, 0x52585c
call fcn.004071a0
mov eax, dword [esp + 0x30]
push 0x50e0a8
push eax
mov byte [esp + 0x19a4], 7
call fcn.004dec69
add esp, 8
test eax, eax
je 0x44d7be
mov ecx, 0x50e0a8
test ecx, ecx
jne 0x44d7a3
xor eax, eax
jmp 0x44d7ae
push 0x50e0a8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x50e0a8
push eax
mov ecx, 0x52585c
call fcn.00407f00
mov eax, dword [esp + 0x30]
mov ecx, dword [0x50d0e4]
mov byte [esp + 0x199c], bl
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x44d7f4
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d7f4
mov eax, dword [esp + 0x30]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
lea ecx, [esp + 0x1580]
mov byte [esp + 0x199c], 3
call fcn.004c44b0
xor ebx, ebx
mov esi, dword [esp + 0x19a4]
cmp esi, 0x131
jne 0x44d992
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push 0x52585c
push edx
call fcn.0040d460
push 0x525858
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x19a4], 8
push eax
call fcn.0040d460
mov eax, dword [esp + 0x24]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 0xa
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d880
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d880
mov edx, dword [esp + 0x24]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x540]
push eax
push ecx
call fcn.004df3e0
mov ecx, dword [ebp + 4]
push 0x81800
lea edx, [esp + 0x54c]
push 0x208
push edx
lea eax, [esp + 0xd74]
push str.BMP__.bmp_
push eax
push ecx
call fcn.004a8a50
add esp, 0x20
cmp eax, ebx
mov eax, dword [esp + 0x18]
mov byte [esp + 0x199c], 3
jg 0x44d967
mov ecx, dword [0x50d0e4]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x44d8fc
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d8fc
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x1c]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d933
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d933
mov edx, dword [esp + 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44de31
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44de31
jmp 0x44de21
mov edx, dword [0x50d0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d992
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d992
mov edx, dword [esp + 0x18]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [ebp + 0xe4]
mov dword [esp + 0x60], ebx
lea edx, [esp + 0x60]
lea ecx, [eax + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [ebp + 0xe4]
mov dword [esp + 0x5c], ebx
lea edx, [esp + 0x5c]
lea ecx, [eax + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp esi, 0x130
mov dword [esp + 0x28], ebx
jne 0x44dd07
cmp dword [esp + 0x58], 3
jne 0x44d9f8
mov eax, dword [ebp + 0xe4]
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 8]
cmp dword [esp + 0x74], 0x60
jne 0x44d9f8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0xe4]
push ebx
mov edx, dword [eax + 0x20]
lea ecx, [eax + 0x20]
lea eax, [esp + 0x2c]
push eax
call dword [edx + 0x78]
test eax, eax
jne 0x44dc05
mov ecx, 0x82
lea edi, [esp + 0x130]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x130]
push 0x104
push ecx
push 0x9f38
call fcn.00432b50
mov edx, dword [0x50d0e0]
add esp, 0xc
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
mov edx, dword [0x52585c]
lea ecx, [esp + 0x130]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s_s__s__
push eax
mov byte [esp + 0x19b0], 0xb
call fcn.004074f0
mov ecx, dword [esp + 0x24]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebx
je 0x44dad5
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, ebx
jl 0x44dac7
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
je 0x44dad5
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44dabc
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [0x50d0e0]
mov dword [esp + 0x10], eax
jmp 0x44dad5
push 0x5209fc
lea ecx, [esp + 0x14]
call fcn.00406e00
mov ecx, dword [0x525858]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x14]
push ecx
push edx
mov edx, dword [0x52585c]
lea ecx, [esp + 0x138]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str._s_s__s__d_s
push eax
call fcn.004074f0
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004de48f
mov ecx, dword [esp + 0x48]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 0x20
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x28]
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xe4]
push edx
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 0x78]
test eax, eax
jne 0x44dbc1
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x540]
push eax
push ecx
call fcn.004df3e0
mov edx, dword [esp + 0x30]
add esp, 8
lea eax, [esp + 0x540]
mov ecx, ebp
push edx
push esi
push eax
call fcn.0044e7f0
cmp eax, ebx
mov dword [esp + 0x70], eax
je 0x44dbc1
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x338]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x33c]
push ecx
push 0x9f39
call fcn.00432b50
mov ecx, dword [ebp + 0xdd4]
add esp, 0xc
lea edx, [esp + 0x338]
lea eax, [esp + 0x540]
push edx
mov edx, dword [ebp + 4]
push eax
push ecx
push ebx
push edx
mov ecx, ebp
call fcn.00464040
cmp esi, ebx
je 0x44dbce
push esi
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 3
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44dc05
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44dc05
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, ebx
jle 0x44dc2a
cmp dword [esp + 0x19a4], 0x131
jne 0x44dc2a
mov eax, dword [ebp + 0xe4]
push edx
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 0x10]
cmp dword [esp + 0x58], 3
jne 0x44dc40
mov eax, dword [ebp + 0xe4]
mov edx, dword [eax + 0x20]
lea ecx, [eax + 0x20]
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44dc77
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44dc77
mov edx, dword [esp + 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44dcae
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44dcae
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x20]
mov edx, dword [0x50d0e4]
mov dword [esp + 0x199c], 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44dce8
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44dce8
mov edx, dword [esp + 0x20]
add edx, 0xfffffff4
push edx
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x1994]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1990
ret 4
cmp esi, 0x131
jne 0x44dc05
cmp dword [esp + 0x58], 3
jne 0x44dd29
mov eax, dword [ebp + 0xe4]
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 8]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x525854]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x48], ecx
mov edi, dword [0x52584c]
mov ecx, dword [edx + 0xe4]
lea edx, [esp + 0x90]
mov ebp, dword [0x525850]
push edx
lea edx, [esp + 0x88]
xor ebx, ebx
push edx
lea edx, [esp + 0x58]
add ecx, 0x20
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x9c], ebx
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x98], edi
mov dword [esp + 0x88], ebp
call dword [eax + 0x5c]
mov esi, dword [esp + 0x24]
cmp esi, ebx
jle 0x44e7b6
cmp dword [esp + 0x50], ebx
jle 0x44e7b6
mov eax, ebp
imul eax, edi
lea ecx, [eax + 2]
mov eax, dword [esp + 0x5c]
cmp eax, ecx
jge 0x44de72
mov eax, dword [esp + 0x1c]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44ddfa
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44ddfa
mov edx, dword [esp + 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44de31
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44de31
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x20]
mov edx, dword [0x50d0e4]
mov dword [esp + 0x199c], 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44de6b
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44de6b
mov edx, dword [esp + 0x20]
add edx, 0xfffffff4
push edx
call fcn.004de3a6
add esp, 4
xor eax, eax
jmp 0x44dcec
cdq
idiv ecx
xor ebx, ebx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x48]
cdq
idiv ebp
mov dword [esp + 0x34], eax
imul eax, dword [esp + 0x50]
cdq
idiv esi
mov ecx, eax
imul ecx, edi
mov eax, ecx
add ecx, 0x46
cdq
idiv edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [esp + 0x90], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
xor eax, eax
cmp edi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0xffffffff
mov dword [esp + 0x54], eax
jle 0x44e78e
mov eax, dword [esp + 0x78]
test eax, eax
jle 0x44e1e9
mov dword [esp + 0x4c], 2
mov dword [esp + 0x7c], eax
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x94]
add ebx, esi
mov eax, dword [edx + 0xe4]
push ebx
lea ecx, [eax + 0x20]
mov eax, dword [eax + 0x20]
call dword [eax + 0x10]
test eax, eax
jne 0x44e1c8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x2c]
push 0
mov eax, dword [ecx + 0xe4]
mov edx, dword [eax + 0x20]
lea ecx, [eax + 0x20]
lea eax, [esp + 0x2c]
push eax
call dword [edx + 0x78]
test eax, eax
jne 0x44e1c8
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004de48f
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0xe4]
mov edx, dword [eax + 0x20]
lea ecx, [eax + 0x20]
lea eax, [esp + 0x2c]
push eax
call dword [edx + 0x78]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x44e059
mov edx, dword [esp + 0x30]
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0xa8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
push eax
mov dword [esp + 0xb0], ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0xb4], edx
push eax
push ecx
lea edx, [esp + 0xb4]
push eax
push edx
push ebp
mov dword [esp + 0xc0], 0x28
mov word [esp + 0xcc], 1
mov word [esp + 0xce], 0x20
mov dword [esp + 0xd0], eax
mov dword [esp + 0x7c], eax
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
push ebp
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 3
push ebp
mov dword [esp + 0x70], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0xffffff
mov dword [esp + 0x70], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esp + 0x30]
mov edi, eax
xor eax, eax
lea edx, [esp + 0x38]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
push edi
push edx
push ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
call dword [sym.imp.USER32.dll_FillRect]
test edi, edi
je 0x44e059
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x50d0e0]
lea edi, [esi + 0x2c]
mov dword [esp + 0x10], eax
mov eax, ebx
mov ecx, 0x3c
cdq
idiv ecx
mov eax, ebx
mov ecx, 0xe10
mov byte [esp + 0x199c], 0xc
push edx
cdq
idiv ecx
mov eax, 0x88888889
mov ecx, edx
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x91a2b3c5
push edx
imul ebx
add edx, ebx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
lea edx, [esp + 0x1c]
push str._02d:_02d:_02d
push edx
call fcn.004074f0
mov eax, dword [esi + 8]
add esp, 0x14
mov ecx, dword [esi + 4]
push 0xcc0020
push 0
push esi
push edi
push eax
mov eax, dword [esp + 0x94]
push ecx
push 0
lea edx, [eax - 4]
push 0
push edx
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x58]
imul edx, eax
mov eax, dword [esp + 0x70]
add ecx, 0xfffffffc
add edx, 0x48
push ecx
push edx
push eax
push ebp
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0xffffff
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push ebp
mov edi, eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x64], eax
lea eax, [edx + ecx - 9]
mov dword [esp + 0xa0], eax
add eax, 0xffffffc4
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x54]
inc eax
imul eax, dword [esp + 0x80]
add eax, 0x45
mov dword [esp + 0xa4], eax
add eax, 0xffffffe7
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x98]
push 0x26
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
push ebp
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esp + 0x64]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkMode]
push edi
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
test esi, esi
je 0x44e191
push esi
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 3
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44e1c8
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e1c8
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x4c]
add ecx, eax
mov eax, dword [esp + 0x7c]
dec eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x7c], eax
jne 0x44defd
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x88]
inc ecx
cmp ecx, edx
mov dword [esp + 0x54], ecx
jl 0x44dee9
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44e78e
mov edi, dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push ebp
call edi
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x130]
mov esi, eax
push 0x104
mov eax, 2
push edx
push 0x9d86
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], 0x12
mov dword [esp + 0x4c], ecx
call fcn.00432b50
lea eax, [esp + 0xf74]
push 0x104
push eax
push 0x9d87
call fcn.00432b50
lea ecx, [esp + 0x1390]
push 0x104
push ecx
push 0x9d88
call fcn.00432b50
lea edx, [esp + 0x1194]
push 0x104
push edx
push 0x9d89
call fcn.00432b50
add esp, 0x30
push esi
push ebp
call edi
mov eax, dword [0x525818]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x50d0e0]
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x130]
push edx
push eax
lea ecx, [esp + 0x18]
push 0x51694c
push ecx
mov byte [esp + 0x19ac], 0xd
call fcn.004074f0
mov eax, dword [esp + 0x20]
mov ebx, dword [sym.imp.USER32.dll_DrawTextW]
add esp, 0x10
lea edx, [esp + 0x38]
mov ecx, dword [eax - 8]
push 0x40024
push edx
push ecx
push eax
push ebp
call ebx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x950]
push eax
push ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
test esi, esi
je 0x44e34c
cmp esi, 0xffffffff
je 0x44e34c
mov eax, dword [esp + 0x96c]
xor ecx, ecx
push 1
push ecx
push ecx
push eax
call fcn.004df990
mov ecx, dword [esp + 0x970]
push edi
add eax, ecx
push 0x100000
adc edx, edi
push edx
push eax
call fcn.004dfa90
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x3c], eax
add eax, 0x12
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x44e3ca
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x44e3a3
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
je 0x44e3ca
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e398
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
mov eax, dword [0x50d0e0]
mov dword [esp + 0x10], eax
jmp 0x44e3ca
mov ecx, 0x5209fc
test ecx, ecx
jne 0x44e3b0
xor eax, eax
jmp 0x44e3bb
push 0x5209fc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5209fc
push eax
lea ecx, [esp + 0x18]
call fcn.004021f0
lea edx, [esp + 0xf68]
push edi
push edx
lea eax, [esp + 0x18]
push str._s__dMB
push eax
call fcn.004074f0
mov eax, dword [esp + 0x20]
add esp, 0x10
lea edx, [esp + 0x38]
mov ecx, dword [eax - 8]
push 0x40024
push edx
push ecx
push eax
push ebp
call ebx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x3c], eax
add eax, 0x12
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x44e47a
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x44e453
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
je 0x44e47a
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e447
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [0x50d0e0]
mov dword [esp + 0x10], ecx
jmp 0x44e47a
mov edx, 0x5209fc
test edx, edx
jne 0x44e460
xor eax, eax
jmp 0x44e46b
push 0x5209fc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5209fc
push eax
lea ecx, [esp + 0x18]
call fcn.004021f0
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
push eax
lea edx, [esp + 0x137c]
push ecx
push edx
lea eax, [esp + 0x1c]
push str._s__d_d
push eax
call fcn.004074f0
mov eax, dword [esp + 0x24]
add esp, 0x14
lea edx, [esp + 0x38]
mov ecx, dword [eax - 8]
push 0x40024
push edx
push ecx
push eax
push ebp
call ebx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x3c], eax
add eax, 0x12
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x44e533
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x44e50c
mov edx, dword [0x50d0e4]
add eax, 0xfffffff4
cmp eax, edx
je 0x44e533
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e500
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004de3a6
add esp, 4
mov ecx, dword [0x50d0e0]
mov dword [esp + 0x10], ecx
jmp 0x44e533
mov edx, 0x5209fc
test edx, edx
jne 0x44e519
xor eax, eax
jmp 0x44e524
push 0x5209fc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5209fc
push eax
lea ecx, [esp + 0x18]
call fcn.004021f0
mov ecx, dword [esp + 0x5c]
mov esi, 0x3c
mov eax, ecx
cdq
idiv esi
mov eax, ecx
mov esi, 0xe10
push edx
cdq
idiv esi
mov eax, 0x88888889
mov esi, edx
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x91a2b3c5
push edx
imul ecx
add edx, ecx
lea eax, [esp + 0x18]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
lea edx, [esp + 0x117c]
push edx
push str._s__02d:_02d:_02d
push eax
call fcn.004074f0
mov eax, dword [esp + 0x28]
add esp, 0x18
lea edx, [esp + 0x38]
mov ecx, dword [eax - 8]
push 0x40024
push edx
push ecx
push eax
push ebp
call ebx
mov eax, dword [esp + 0x34]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, 0x17
xor eax, eax
lea edi, [esp + 0xd4]
push str.Arial_Black
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.004df3e0
add esp, 8
lea edx, [esp + 0xd4]
mov dword [esp + 0xd4], 0x30
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov esi, eax
push esi
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push 0x40026
sub ecx, 0xa
push eax
push str.Qvod_Player
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], ecx
call fcn.004debba
add esp, 4
push eax
push str.Qvod_Player
push ebp
call ebx
test esi, esi
je 0x44e63c
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x68]
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xa8]
push 0
push edx
push 0
push ecx
push 0
push eax
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov edx, dword [esp + 0xbc]
add edx, 0x2c
push edx
call fcn.004de48f
mov ebx, eax
mov edx, dword [esp + 0x34]
mov ecx, 0xb
lea esi, [esp + 0xac]
mov edi, ebx
add esp, 4
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa8]
lea eax, [ebx + 0x2c]
push 0
push ecx
push eax
mov eax, dword [esp + 0x24]
push edx
push 0
push eax
push ebp
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, dword [esp + 0xbc]
mov esi, dword [esp + 0x2c]
add ecx, 0x2c
lea edx, [esp + 0x540]
push ecx
push ebx
push edx
mov ecx, esi
call fcn.0044e7f0
test eax, eax
je 0x44e71e
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x338]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x33c]
push eax
push 0x9f39
call fcn.00432b50
mov eax, dword [esi + 0xdd4]
add esp, 0xc
lea ecx, [esp + 0x338]
lea edx, [esp + 0x540]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push 0
push ecx
mov ecx, esi
call fcn.00464040
mov edx, dword [esp + 0x34]
push edx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
je 0x44e73b
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
test ebx, ebx
je 0x44e748
push ebx
call fcn.004de3a6
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44e757
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x10]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 3
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44e78e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e78e
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004de3a6
add esp, 4
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x8c]
push eax
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
jmp 0x44dc05
mov eax, dword [esp + 0x1c]
mov edx, dword [0x50d0e4]
mov byte [esp + 0x199c], 1
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x44d933
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44d933
jmp 0x44d923