Function at 0x46e1bd
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x148
push esi
push edi
push 4
pop esi
mov edi, edx
mov dword [esp + 0x30], ecx
push esi
lea ecx, [esp + 0xf4]
mov dword [esp + 0x6c], edi
call fcn.0043492e
mov dword [esp + 0x1c], 0x7f2fb5a5
xor eax, eax
mov dword [esp + 0x1c], 6
mov dword [esp + 0x18], 1
mov dword [esp + 8], eax
jmp 0x46e21b
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xf0]
mov dword [ecx + edx*4], 7
inc dword [esp + 8]
cmp dword [esp + 8], esi
jl 0x46e205
mov dword [esp + 8], eax
jmp 0x46e23a
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0xa4], 0xba76aabe
inc dword [esp + 8]
cmp dword [esp + 8], esi
jl 0x46e227
mov dword [esp + 0xac], eax
jmp 0x46e27c
mov dword [esp + 0x20], eax
mov esi, dword [esp + 0xac]
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0x20]
mov ecx, dword [ecx + esi*4]
dec dword [esp + 0x20]
cmp edx, ecx
jg 0x46e26f
xor ecx, ecx
inc ecx
jmp 0x46e271
mov ecx, eax
mov dword [esp + 0x18], ecx
inc dword [esp + 0xac]
cmp dword [esp + 0xac], 3
jle 0x46e249
lea ecx, [esp + 0xf0]
call fcn.00434a00
xor eax, eax
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 0x10], eax
jmp 0x46e2b5
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xe4], 0xad6f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x46e2a2
push 2
mov dword [esp + 0xc], eax
pop esi
jmp 0x46e324
mov dword [esp + 0x10], 1
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e2e6
push 0xa47
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], eax
jl 0x46e320
mov ecx, dword [esp + 8]
mov edx, dword [esp + ecx*4 + 0xe4]
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xe4], edx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e31a
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor eax, eax
dec dword [esp + 0x10]
jns 0x46e2f0
inc dword [esp + 8]
cmp dword [esp + 8], esi
jle 0x46e2c5
mov ecx, dword [esp + 0xe4]
sub ecx, dword [esp + 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 8], ecx
mov ecx, dword [0xaa7f24]
test cl, 1
jne 0x46e3cd
push eax
or ecx, 1
mov dword [0xaa7f30], eax
push eax
mov dword [0xaa7f24], ecx
mov dword [0xaa7f34], eax
call fcn.00404465
mov ecx, eax
mov dword [0xaa7f4c], 0x3f800000
mov dword [0xaa7f30], ecx
xor eax, eax
mov dword [esp + 0x80], ecx
lea ecx, [esp + 0x80]
push ecx
push 0x10
push eax
mov dword [0xaa7f38], eax
mov ecx, 0xaa7f38
mov dword [0xaa7f40], eax
mov dword [0xaa7f3c], eax
lea eax, [esp + 0x12c]
push eax
call fcn.0040419b
push 0x4ad235
mov dword [0xaa7f44], 7
mov dword [0xaa7f48], 8
call fcn.0048951f
pop ecx
xor esi, esi
mov dword [esp + 0x10], esi
jmp 0x46e3e5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x46e3d5
mov dword [esp + 0x4c], esi
jmp 0x46e45b
push 1
lea ecx, [esp + 0x10c]
call fcn.0043492e
xor edx, edx
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], esi
jmp 0x46e423
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xfffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x46e40d
mov dword [esp + 0x10], esi
jmp 0x46e445
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x46e42f
lea ecx, [esp + 0x108]
call fcn.00434a00
dec dword [esp + 0x4c]
cmp dword [esp + 0x4c], 0xfffffff1
je 0x46e3f2
imul eax, dword [esp + 0x30], 0x2710
lea ecx, [esp + 0xc0]
push 2
add eax, edi
mov dword [esp + 0x58], eax
call fcn.0043492e
mov dword [esp + 0x20], 0x919adb82
mov dword [esp + 0x24], 0x49c23edb
mov dword [esp + 0x18], esi
mov dword [esp + 8], esi
jmp 0x46e4ae
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0x65683c8f
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x46e498
push 3
mov dword [esp + 0xc], esi
pop ecx
jmp 0x46e4cd
mov eax, dword [esp + 8]
mov dword [esp + eax*4 + 0x134], ecx
inc dword [esp + 8]
cmp dword [esp + 8], ecx
jl 0x46e4be
mov edx, dword [esp + 0xc0]
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp dword [edx + 4], eax
setl cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [esp + 0xc0]
setns cl
sub ecx, dword [eax]
sub ecx, dword [edx + 4]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc0]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x18], 0x5a61940c
call fcn.00434a00
lea eax, [esp + 0x54]
push eax
call fcn.0046f133
xor esi, esi
inc esi
mov edi, dword [eax]
xor eax, eax
mov dword [esp + 0x10], 0xfffffffa
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0x60d64c9d
mov dword [esp + 0x84], 0xfffffffd
mov dword [esp + 0x18], 0x650dfa01
mov dword [esp + 0x14], 0x60be6286
mov dword [esp + 0x1c], edi
mov dword [esp + 8], eax
jmp 0x46e586
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x64], 0xffffffff
inc dword [esp + 8]
cmp dword [esp + 8], esi
jl 0x46e576
mov dword [esp + 8], eax
jmp 0x46e5a1
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x114], eax
inc dword [esp + 8]
cmp dword [esp + 8], 3
jl 0x46e592
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jg 0x46e786
mov dword [esp + 8], 0x2a2c7c8a
lea ecx, [esp + 0xfc]
push 3
call fcn.0043492e
mov dword [esp + 0x20], 0xfe86
xor eax, eax
mov dword [esp + 0x24], 0x21248c33
mov dword [esp + 0x18], 0xcbc84235
mov dword [esp + 8], eax
jmp 0x46e602
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xfc]
mov dword [ecx + edx*4], 0xec80f219
inc dword [esp + 8]
cmp dword [esp + 8], 3
jl 0x46e5ec
mov dword [esp + 8], eax
cmp dword [esp + 8], eax
jl 0x46e766
mov ecx, dword [esp + 0xfc]
mov edi, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], 0xa2f3817d
mov dword [esp + 0x18], 0x79df9481
mov dword [esp + 0x18], 0xca955a63
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], 0x7dd9ae65
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e66d
push esi
push 0x16fa
push 0x1a27
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
cmp dword [esp + 8], eax
jne 0x46e6ad
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x84]
cmp edx, ecx
push 0
pop ecx
setg cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 8], eax
jne 0x46e6ad
mov esi, eax
dec dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
add edx, dword [edi + 4]
cmp esi, 4
push 0
sbb ecx, ecx
mov dword [edi + 8], edx
neg ecx
cmp edx, ecx
pop ecx
setge cl
sub ecx, dword [esp + 0x20]
neg ecx
push 0
sbb ecx, ecx
add ecx, 0xffff0fb9
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x2c], ecx
setle dl
xor ecx, ecx
test edx, edx
setg cl
xor edx, edx
cmp ecx, 0xd47e
mov ecx, dword [esp + 0x14]
setg dl
cmp edx, ecx
pop ecx
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 8]
push 1
pop esi
mov ecx, dword [esp + ecx*4 + 0x64]
cmp ecx, dword [esp + 0x28]
setne dl
xor ecx, ecx
add edx, dword [esp + 0x2c]
cmp edx, 0xfffffffa
setne cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x11c], ecx
dec dword [esp + 8]
jns 0x46e624
lea ecx, [esp + 0xfc]
call fcn.00434a00
inc dword [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x10], eax
jle 0x46e5b6
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x46e796
mov dword [esp + 0x88], edi
jmp 0x46f0af
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 8], 0xfffc
push 3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
pop edi
jmp 0x46e7c7
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x34], 0x1dbeccce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x46e7b7
mov ecx, dword [esp + 0x3c]
mov edx, eax
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], eax
je 0x46e7ef
mov edx, esi
mov ecx, dword [esp + 0x3c]
add ecx, edx
je 0x46e805
cmp dword [esp + 0x38], eax
je 0x46e805
mov ecx, esi
cmp dword [esp + 8], eax
jne 0x46e807
mov ecx, eax
neg ecx
cmp ecx, dword [esp + 0x34]
jl 0x46e817
mov edx, eax
cmp dword [esp + 8], eax
je 0x46e819
mov edx, esi
xor ecx, ecx
cmp edx, 0xbaee
setge cl
cmp ecx, 0xfffffffe
jge 0x46e998
mov dword [esp + 0x20], 0x93208af0
mov dword [esp + 8], 9
mov dword [esp + 0x24], 0x1d66bd5d
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], eax
jne 0x46e873
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x10]
sub esi, ecx
mov ecx, dword [esp + 0x14]
neg esi
sbb esi, esi
sub ecx, 0x7a22f0f5
inc esi
sub esi, ecx
mov ecx, dword [esp + 0x3c]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [esp + 0x14]
setne dl
sub edx, 0x4a132979
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
xor edx, edx
cmp dword [esp + 0x1c], ecx
setge dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
dec ecx
mov dword [esp + 0x14], ecx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e8f9
push 0x1661
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor eax, eax
xor esi, esi
inc esi
mov ecx, dword [0xaa7f24]
test cl, 2
jne 0x46e97e
push eax
or ecx, 2
mov dword [0xaa7f50], eax
push eax
mov dword [0xaa7f24], ecx
mov dword [0xaa7f54], eax
call fcn.00404465
mov ecx, eax
mov dword [0xaa7f6c], 0x3f800000
mov dword [0xaa7f50], ecx
xor eax, eax
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x7c]
push ecx
push 0x10
push eax
mov dword [0xaa7f58], eax
mov ecx, 0xaa7f58
mov dword [0xaa7f60], eax
mov dword [0xaa7f5c], eax
lea eax, [esp + 0x78]
push eax
call fcn.0040419b
push 0x4ad230
mov dword [0xaa7f64], 7
mov dword [0xaa7f68], 8
call fcn.0048951f
pop ecx
mov dword [esp + 0x14], esi
lea ecx, [esp + 0xd8]
push 2
call fcn.0043492e
xor esi, esi
mov dword [esp + 0x14], esi
jmp 0x46ea13
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esp + 0x1c], eax
je 0x46e9df
mov dword [esp + 8], eax
jmp 0x46e9bc
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x34], 7
inc dword [esp + 8]
cmp dword [esp + 8], edi
jl 0x46e9ac
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e8fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x46e8fc
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46e8fc
push 0x1aff
push 0x49b
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x46e9d8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x46ea01
mov dword [esp + 0x14], 4
cmp dword [esp + 0x14], 0x10
jg 0x46ea4a
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x1c], 0x18d5
mov eax, dword [esp + 0x1c]
mov dword [ecx + 4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jle 0x46ea30
lea ecx, [esp + 0xd8]
call fcn.00434a00
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [esp + 0x94], xmm0
mov dword [esp + 8], 0xfffffff6
mov dword [esp + 8], eax
jmp 0x46eaa0
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46ea86
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46ea9c
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
dec dword [esp + 8]
cmp dword [esp + 8], 0xffffffed
jge 0x46ea72
mov eax, dword [esp + 8]
lea eax, [esp + 0x30]
mov dword [esp + 8], 0x8f8256a
push eax
call fcn.0046f195
mov esi, dword [eax]
xor eax, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
jmp 0x46eadb
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x40], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x46eacb
mov dword [esp + 0x44], 0x18
cmp dword [esp + 0x44], 0x1a
jg 0x46eca5
jmp 0x46eaf8
xor eax, eax
mov dword [esp + 8], 1
mov dword [esp + 0x1c], 0xbf8c3261
cmp dword [esp + 8], eax
je 0x46eb23
mov dword [esp + 0x1c], 0xfffffffc
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
jmp 0x46ebec
mov dword [esp + 0x18], 0x167c28ca
mov dword [esp + 8], eax
jmp 0x46ebcf
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x10], 5
jmp 0x46ebc4
mov dword [esp + 0x24], 0xd711a53f
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x18], eax
je 0x46eb76
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
cmp dword [esp + 0x14], eax
je 0x46eb76
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
test ecx, ecx
mov ecx, dword [esp + 0x10]
sets dl
cmp edx, ecx
mov ecx, dword [esp + 0x14]
push 0
pop edx
setg dl
cmp edx, ecx
mov ecx, dword [esp + 0x14]
push 0
pop edx
setle dl
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
add edx, ecx
jne 0x46ebb9
cmp dword [esp + 8], eax
jne 0x46ebb9
mov ecx, eax
jmp 0x46ebbc
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe9
je 0x46eb4e
dec dword [esp + 8]
cmp dword [esp + 8], 0xffffffe3
je 0x46eb34
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46ebec
push eax
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [esp + 8], 0xffffffea
jmp 0x46ec8b
push 2
lea ecx, [esp + 0xb8]
call fcn.0043492e
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x46ec25
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xb4]
mov dword [ecx + edx*4], 0x4648a574
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x46ec0f
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xb4]
imul edx, dword [ecx]
test edx, edx
je 0x46ec42
mov ecx, dword [esp + 0x44]
cmp dword [esp + 0x44], 0x5601
jl 0x46ec57
cmp dword [esp + 0x44], eax
je 0x46ec57
xor edi, edi
inc edi
jmp 0x46ec59
mov edi, eax
mov ecx, dword [esp + 0xb4]
xor edx, edx
cmp edi, dword [ecx]
setg dl
imul edx, dword [ecx]
test edx, edx
je 0x46ec77
cmp dword [esp + 8], eax
je 0x46ec77
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xb4]
call fcn.00434a00
dec dword [esp + 8]
cmp dword [esp + 8], 0xffffffe4
je 0x46ebf9
inc dword [esp + 0x44]
cmp dword [esp + 0x44], 0x1a
jle 0x46eaf6
mov al, byte [ebp + 0xc]
test al, al
jne 0x46ecb0
test esi, esi
jne 0x46ecfb
lea ecx, [esp + 0x140]
mov dl, al
push ecx
mov ecx, dword [esp + 0x34]
call fcn.00434ca1
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x98]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x20]
je 0x46ecfb
mov ecx, dword [esp + 0x9c]
test ecx, ecx
je 0x46ecfb
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0xaa0ae0]
lea ecx, [esp + 0x138]
push ecx
xor eax, eax
lea ecx, [esp + 0x12c]
push ecx
push eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x80], eax
movdqu xmmword [esp + 0x134], xmm0
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
call fcn.00434a71
xor eax, eax
mov dword [esp + 8], 0x8901f2c
xor edi, edi
mov dword [esp + 8], eax
inc edi
cmp dword [esp + 8], 4
jge 0x46ed6d
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x70]
mov dword [ecx + edx*4], edi
inc dword [esp + 8]
jmp 0x46ed55
mov dword [esp + 8], 0xffffffe8
jmp 0x46ed94
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x46ed90
push 0x20a
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
inc dword [esp + 8]
cmp dword [esp + 8], 0x12
jge 0x46ed77
lea ecx, [esp + 0x70]
call fcn.00434a00
test esi, esi
jne 0x46edd3
cmp dword [esp + 0x94], esi
jle 0x46edd3
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x46edd3
call fcn.0046db95
mov esi, eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x24], esi
call fcn.0046f195
mov dword [eax], esi
mov dword [esp + 8], 0x1928c176
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x46ee0e
push eax
push 0xccb
push eax
push 0x17c0
push 0x354
push eax
push 0x203f
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
mov dword [esp + 8], eax
jmp 0x46ef20
mov dword [esp + 0x10], 0xfeca
lea ecx, [esp + 0xcc]
push 4
call fcn.0043492e
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
jmp 0x46ee4f
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xcc]
mov dword [ecx + edx*4], 0x8bd85027
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x46ee39
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xcc]
mov dword [ecx + 0xc], edx
cmp dword [esp + 8], eax
je 0x46ee6e
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 8]
sub esi, ecx
mov ecx, dword [esp + 8]
neg esi
push 0
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [esp + 0x14]
setl dl
cmp edx, ecx
mov ecx, dword [esp + 0x14]
pop edx
setle dl
cmp edx, ecx
push 0
pop edx
setg dl
xor ecx, ecx
cmp edx, 0x5fba2522
setle cl
xor edx, edx
add ecx, dword [esp + 0x10]
imul ecx, ecx, 0xf82b
cmp ecx, 0x2f5a260d
mov ecx, dword [esp + 8]
setg dl
mov dword [esp + 0x1c], edx
xor edx, edx
cmp dword [esp + 0x1c], ecx
setg dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x10], ecx
jle 0x46eee7
cmp dword [esp + 8], eax
je 0x46eee7
mov eax, edi
mov ecx, dword [esp + 8]
xor edx, edx
sub ecx, eax
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [esp + 8]
mov eax, dword [esp + 8]
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xcc]
call fcn.00434a00
dec dword [esp + 8]
cmp dword [esp + 8], 0xffffffee
jge 0x46ee17
lea ecx, [esp + 0x94]
call fcn.0043635f
xor esi, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x58]
push 3
call fcn.0043492e
mov dword [esp + 8], 0xffffffff
xor eax, eax
mov dword [esp + 0x24], 0xfffffffd
mov dword [esp + 0x14], eax
jmp 0x46ef77
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x58]
mov dword [ecx + edx*4], 0x3111738a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x46ef64
cmp dword [esp + 0x18], eax
je 0x46eff1
cmp dword [esp + 0x10], eax
je 0x46efa1
mov edx, dword [esp + 0x58]
mov ecx, dword [edx + 8]
mov dword [edx], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x58]
add edx, dword [ecx]
mov ecx, edi
jne 0x46efa3
mov ecx, eax
neg ecx
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
dec dword [esp + 8]
cmp dword [esp + 8], ecx
jle 0x46efbc
cmp dword [esp + 0x10], eax
je 0x46eff1
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [ecx + 4]
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x46f080
push eax
push eax
push 0x1383
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x46f080
mov dword [esp + 0x14], 0xc28c
cmp dword [esp + 0x10], eax
je 0x46f005
cmp dword [esp + 0x14], eax
jne 0x46f007
mov edi, eax
mov ecx, dword [esp + 0x58]
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x10]
add ecx, 0x5d598096
mov esi, dword [esp + 0x2c]
cmp ecx, 0xffff
mov ecx, dword [esp + 0x14]
push 0
setne dl
cmp edx, ecx
pop ecx
setl cl
xor edx, edx
imul ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x24]
cmp edi, ecx
setge dl
xor ecx, ecx
cmp edx, dword [esp + 0x1c]
setl cl
cmp ecx, dword [esi + 4]
jge 0x46f064
mov ecx, dword [esp + 0x58]
cmp dword [ecx + 8], eax
je 0x46f067
xor eax, eax
inc eax
mov ecx, dword [esp + 8]
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esi + 4], ecx
lea ecx, [esp + 0x58]
call fcn.00434a00
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x46f0af
mov edx, dword [esp + 0x68]
call fcn.0046df19
mov esi, eax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x8c], esi
call fcn.0046f133
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x88]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret