Function at 0x472be0
Capabilities:
Create process memory minidump

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fde01
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x248
mov eax, dword [0x534090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1fc], edi
mov al, byte [ebx + 8]
mov byte [ebp - 0x1ed], al
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x200], eax
mov eax, dword [edi + 0x34fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x2be88]
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x474cb8
cmp eax, 0xffffffff
je 0x474cb8
mov dword [ebp - 0x110], 0
xor eax, eax
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 7
mov word [ebp - 0x110], ax
push 5
push str.BDCH_
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], 4
call fcn.0043a570
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.00472340
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x472cc4
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.0043a570
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x472d0f
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x472d05
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474f0a
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov ecx, dword [ebp - 0x100]
mov edx, SysReAllocString
mov edi, dword [ebp - 0xfc]
mov dword [ebp - 0x1e0], ecx
cmp ecx, edi
jae 0x472d4f
lea eax, [ecx + 1]
cmp edi, 8
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
mov dword [eax + ecx*2], 0x5f
jmp 0x472e39
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x474f9d
lea eax, [ecx + 1]
mov esi, eax
mov dword [ebp - 0x1f8], eax
or esi, 7
cmp esi, edx
jbe 0x472d72
mov esi, edx
jmp 0x472d8a
mov ecx, edi
mov eax, edx
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x472d82
mov esi, edx
jmp 0x472d8a
lea eax, [ecx + edi]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x110]
call fcn.0043ad40
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp - 0x100], ecx
mov ecx, dword [ebp - 0x1e0]
add ecx, ecx
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x1f4], eax
push ecx
lea esi, [eax + ecx]
mov dword [ebp - 0x1f8], esi
cmp edi, 8
jb 0x472e17
mov esi, dword [ebp - 0x110]
push esi
push eax
call fcn.004cd290
mov eax, dword [ebp - 0x1f8]
add esp, 0xc
mov dword [eax], 0x5f
mov eax, edi
lea ecx, [eax*2 + 2]
cmp ecx, 0x1000
jb 0x472e0b
mov edx, dword [esi - 4]
add ecx, 0x23
sub esi, edx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x474f0f
mov esi, edx
push ecx
push esi
call fcn.004cb66f
add esp, 8
jmp 0x472e2d
lea ecx, [ebp - 0x110]
push ecx
push eax
call fcn.004cd290
add esp, 0xc
mov dword [esi], 0x5f
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax + 0x34fc]
mov edx, dword [eax]
add edx, 0x186f8
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472e52
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.0043a570
cmp byte [ebp - 0x1ed], 0
mov edx, str._FULL
mov eax, str._MINI
cmove edx, eax
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472e87
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.0043a570
mov edx, dword [ebp - 0x100]
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1f4], ecx
cmp edx, ecx
jae 0x472ee4
lea eax, [edx + 1]
cmp ecx, 8
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
mov dword [eax + edx*2], 0x5f
jmp 0x472fe6
mov eax, SysReAllocString
sub eax, edx
cmp eax, 1
jb 0x474f9d
lea eax, [edx + 1]
mov esi, eax
mov dword [ebp - 0x1f8], eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x472f11
mov esi, SysReAllocString
jmp 0x472f2f
mov edx, ecx
mov eax, SysReAllocString
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x472f27
mov esi, SysReAllocString
jmp 0x472f2f
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x110]
call fcn.0043ad40
mov ecx, dword [ebp - 0x1f8]
mov dword [ebp - 0x100], ecx
mov ecx, dword [ebp - 0x1dc]
add ecx, ecx
mov dword [ebp - 0xfc], esi
cmp dword [ebp - 0x1f4], 8
mov dword [ebp - 0x1e0], eax
push ecx
lea esi, [ecx + eax]
mov dword [ebp - 0x1f8], esi
jb 0x472fc4
mov esi, dword [ebp - 0x110]
push esi
push eax
call fcn.004cd290
mov eax, dword [ebp - 0x1f8]
add esp, 0xc
mov dword [eax], 0x5f
mov eax, dword [ebp - 0x1f4]
lea ecx, [eax*2 + 2]
cmp ecx, 0x1000
jb 0x472fb8
mov edx, dword [esi - 4]
add ecx, 0x23
sub esi, edx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x474f0f
mov esi, edx
push ecx
push esi
call fcn.004cb66f
add esp, 8
jmp 0x472fda
lea ecx, [ebp - 0x110]
push ecx
push eax
call fcn.004cd290
add esp, 0xc
mov dword [esi], 0x5f
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x1fc]
lea esi, [ebp - 0x56]
mov dword [ebp - 0x1f4], esi
mov eax, dword [eax + 0x34fc]
mov eax, dword [eax]
mov ecx, dword [eax + 0x2de94]
mov edi, dword [eax + 0x2de90]
mov dword [ebp - 0x1dc], edi
test ecx, ecx
jne 0x473020
cmp edi, 0xffffffff
jbe 0x473136
nop dword [eax]
mov eax, edi
mov dword [ebp - 0x1e0], ecx
mov edx, 0x6d694b2f
mul edx
mov dword [ebp - 0x218], eax
mov esi, edx
mov eax, edi
mov edx, 0x12e0be82
mul edx
mov edi, eax
mov dword [ebp - 0x208], edx
mov eax, ecx
mov ecx, 0x6d694b2f
mul ecx
mov ecx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x1e0]
mov edx, 0x12e0be82
mul edx
add ecx, esi
mov dword [ebp - 0x1ec], edx
mov edx, dword [ebp - 0x1f8]
mov esi, dword [ebp - 0x1ec]
adc edx, 0
add edi, ecx
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x208]
adc ecx, 0
mov dword [ebp - 0x218], edi
mov edi, dword [ebp - 0x1dc]
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x204]
adc eax, eax
add ecx, edx
mov edx, edi
adc esi, eax
mov eax, dword [ebp - 0x1e0]
sub edx, ecx
sbb eax, esi
shrd edx, eax, 1
shr eax, 1
add edx, ecx
adc eax, esi
mov esi, dword [ebp - 0x1f4]
shrd edx, eax, 0x1d
shr eax, 0x1d
mov dword [ebp - 0x1e0], eax
imul eax, edx, 0x3b9aca00
sub edi, eax
mov ecx, edi
mov edi, edx
mov dword [ebp - 0x1dc], edi
mov edi, 9
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
sub edi, 1
jne 0x4730f0
mov ecx, dword [ebp - 0x1e0]
mov edi, dword [ebp - 0x1dc]
mov dword [ebp - 0x1f4], esi
test ecx, ecx
ja 0x473020
jb 0x473136
cmp edi, 0xffffffff
ja 0x473020
mov eax, 0xcccccccd
sub esi, 2
mul edi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub edi, eax
add edi, 0x30
mov word [esi], di
mov edi, edx
test edi, edi
jne 0x473136
mov dword [ebp - 0xec], edx
xor eax, eax
mov byte [ebp - 4], 4
mov word [ebp - 0xec], ax
xor ecx, ecx
lea eax, [ebp - 0x56]
mov dword [ebp - 0xdc], ecx
mov edx, 7
mov dword [ebp - 0xd8], edx
cmp esi, eax
je 0x4731a0
sub eax, esi
lea ecx, [ebp - 0xec]
sar eax, 1
push eax
push esi
call fcn.0043add0
mov edx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xdc]
cmp edx, 8
mov byte [ebp - 4], 7
lea eax, [ebp - 0xec]
cmovae eax, dword [ebp - 0xec]
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.0043a570
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xd8]
cmp edx, 8
jb 0x473205
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4731fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474f0f
push edx
push ecx
call fcn.004cb66f
add esp, 8
push 4
push str..dmp
lea ecx, [ebp - 0x110]
call fcn.0043a570
mov byte [ebp - 0x1ec], 0
lea edx, [ebp - 0x110]
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1c8]
call fcn.0041d280
add esp, 4
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax + 0x34fc]
mov edx, dword [eax]
add edx, 0x2be90
mov ecx, edx
mov dword [ebp - 0x218], edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473257
sub ecx, esi
mov dword [ebp - 0xec], 0
sar ecx, 1
push ecx
xor eax, eax
mov dword [ebp - 0xdc], 0
push edx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
mov byte [ebp - 4], 8
call fcn.0043add0
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.0043a3c0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x30]
call fcn.00438f10
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0043a3c0
mov edi, 0x73000000
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], edi
call fcn.0043b020
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xd8]
cmp edx, 8
jb 0x473327
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47331d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474f14
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x1b4]
cmp eax, 8
jb 0x473349
inc eax
lea ecx, [ebp - 0x1c8]
push eax
push dword [ebp - 0x1c8]
call fcn.0043afe0
xor eax, eax
mov dword [ebp - 0x1b8], 0
mov word [ebp - 0x1c8], ax
mov ecx, 0x60
mov eax, dword [ebp - 0x1fc]
mov esi, 0x1060
mov edx, 0x80
mov dword [ebp - 0x1b4], 7
mov eax, dword [eax + 0x34fc]
mov eax, dword [eax]
mov al, byte [eax + 0x26749]
test al, al
mov dword [ebp - 0x258], 0x18
lea eax, [ebp - 0x110]
mov dword [ebp - 0x24c], 0x42
cmovne esi, ecx
mov dword [ebp - 0x248], 0
mov ecx, 0x180
mov dword [ebp - 0x1ec], esi
cmovne ecx, edx
mov dword [ebp - 0x244], 0
cmp dword [ebp - 0xfc], 8
mov dword [ebp - 0x204], ecx
cmovae eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x100]
add eax, eax
mov edi, dword [ecx]
mov word [ebp - 0x220], ax
mov word [ebp - 0x21e], ax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x250], eax
cmp edi, 0xffffffff
je 0x473445
test edi, edi
je 0x473445
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0x200]
mov eax, dword fs:[0x2c]
mov dword [ecx], 0xffffffff
mov edi, dword [eax]
mov eax, dword [0x53935c]
cmp eax, dword [edi + 4]
jg 0x474f19
jmp 0x47346c
mov ecx, dword [ebp - 0x200]
mov eax, dword [0x539360]
test eax, eax
je 0x474af2
push 0
push 0
push esi
push 0
push 7
push dword [ebp - 0x204]
lea edx, [ebp - 0x210]
push 0
push edx
lea edx, [ebp - 0x258]
push edx
push 0xc0110000
push ecx
call eax
test eax, eax
jne 0x474af2
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4735bb
cmp dword [ebp - 0x19c], 8
lea eax, [ebp - 0x1b0]
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x80758044
cmovae eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x1e4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x8070806d
mov dword [ebp - 0x2c], 0x80668020
mov dword [ebp - 0x28], 0x806c8069
mov dword [ebp - 0x24], 0x803a8065
mov dword [ebp - 0x20], 0x807b8020
mov dword [ebp - 0x1c], 0x8000807d
mov word [ebp - 0x18], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x198]
cmp dword [ebp - 0x184], 8
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1e0], 0x73000001
cmovae eax, dword [ebp - 0x198]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.004177d0
add esp, 4
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0xec]
push eax
mov dword [ebp - 0x1e0], 0x73000003
call fcn.0043a3c0
mov dword [ebp - 4], 0x14
lea esi, [ebp - 0xec]
cmp dword [ebp - 0xd8], 8
mov edi, 0x73000007
mov dword [ebp - 0x1dc], edi
cmovae esi, dword [ebp - 0xec]
mov dword [ebp - 0x1e0], edi
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test al, 4
je 0x4735df
and eax, 0xfffffffb
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test al, 2
je 0x4735fd
and eax, 0xfffffffd
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test al, 1
je 0x47361c
and eax, 0xfffffffe
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov edx, dword [ebp - 0x1fc]
mov dword [ebp - 0x238], 1
mov ecx, dword [edx + 0x34fc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2040c]
mov dword [ebp - 0x23c], eax
mov eax, dword [ecx]
mov cl, byte [ebp - 0x1ed]
mov eax, dword [eax + 0x20408]
mov dword [ebp - 0x240], eax
mov eax, dword [edx]
mov dword [ebp - 0x234], eax
mov eax, dword [edx + 4]
xor edx, edx
mov dword [ebp - 0x230], eax
test cl, cl
lea eax, [ebp - 0x234]
mov byte [ebp - 0x22c], cl
mov dword [ebp - 0x224], eax
mov eax, 0x1b25
cmove eax, edx
mov dword [ebp - 0x228], 0x471f60
mov dword [ebp - 0x208], eax
xor al, al
mov byte [ebp - 0x1e5], al
nop dword [eax + eax]
test al, al
je 0x4736d7
mov eax, dword [ebp - 0x200]
push 0
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x47469b
mov eax, dword [ebp - 0x200]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4745fc
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x473914
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xd0], 0x8069804d
mov dword [ebp - 0xcc], 0x8069806e
mov dword [ebp - 0xc8], 0x80758044
mov eax, dword [eax + 0x34fc]
mov dword [ebp - 0xc4], 0x8070806d
mov dword [ebp - 0xc0], 0x80728057
mov dword [ebp - 0xbc], 0x80748069
mov esi, dword [eax]
xor eax, eax
mov dword [ebp - 0xb8], 0x80448065
mov dword [ebp - 0xb4], 0x806d8075
mov dword [ebp - 0xb0], 0x80208070
mov dword [ebp - 0xac], 0x80548053
mov dword [ebp - 0xa8], 0x80528041
mov dword [ebp - 0xa4], 0x802c8054
mov dword [ebp - 0xa0], 0x80508020
mov dword [ebp - 0x9c], 0x806f8072
mov dword [ebp - 0x98], 0x80658063
mov dword [ebp - 0x94], 0x80738073
mov dword [ebp - 0x90], 0x80448049
mov dword [ebp - 0x8c], 0x803d8020
mov dword [ebp - 0x88], 0x807b8020
mov dword [ebp - 0x84], 0x802c807d
mov dword [ebp - 0x80], 0x80508020
mov dword [ebp - 0x7c], 0x806f8072
mov dword [ebp - 0x78], 0x80658063
mov dword [ebp - 0x74], 0x80738073
mov dword [ebp - 0x70], 0x80618048
mov dword [ebp - 0x6c], 0x8064806e
mov dword [ebp - 0x68], 0x8065806c
mov dword [ebp - 0x64], 0x803d8020
mov dword [ebp - 0x60], 0x807b8020
mov dword [ebp - 0x5c], 0x8000807d
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
mov ecx, dword [esi + 0x19904]
or eax, 8
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x1dc], eax
cmovae edx, dword [ebp - 0x30]
mov dword [ebp - 0x1e0], eax
mov eax, dword [esi + 0x19900]
mov dword [ebp - 0x188], ecx
mov ecx, edx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x20c]
lea esi, [ecx + 2]
mov dword [ebp - 0x184], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473870
sub ecx, esi
sub esp, 0x10
mov eax, esp
sar ecx, 1
lea esi, [ebp - 0x190]
push ecx
push edx
lea ecx, [ebp - 0x128]
mov dword [eax], 0xe2
mov dword [eax + 4], 0
mov dword [eax + 8], esi
call fcn.0041d9e0
add esp, 0x18
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0x4c]
mov eax, dword [ebp - 0x1dc]
or eax, 0x10
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043a3c0
mov dword [ebp - 4], 0x1d
lea esi, [ebp - 0x4c]
mov eax, dword [ebp - 0x1dc]
or eax, 0x20
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1dc], eax
cmovae esi, dword [ebp - 0x4c]
mov dword [ebp - 0x1e0], eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test al, 0x20
je 0x473935
and eax, 0xffffffdf
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test al, 0x10
je 0x473953
and eax, 0xffffffef
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test al, 8
je 0x47396f
and eax, 0xfffffff7
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
push 0x30
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.004cd810
lea eax, [ebp - 0x160]
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x214], eax
add esp, 0xc
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax + 0x34fc]
mov eax, dword [eax]
lea edi, [eax + 0x1cf78]
test edi, edi
je 0x4739b6
cmp word [edi], 0
jne 0x4739bb
mov edi, 0x517e4c
add eax, 0x1e9c0
mov dword [ebp - 0x1e4], edi
mov dword [ebp - 0x1f8], eax
je 0x4739d4
cmp word [eax], 0
jne 0x4739df
mov eax, 0x517e4c
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x204], eax
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x473af3
xor eax, eax
mov dword [ebp - 0x7c], 0x80738055
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x80728065
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x74], 0x80538020
mov dword [ebp - 0x70], 0x80728074
mov dword [ebp - 0x6c], 0x80618065
mov dword [ebp - 0x68], 0x8020806d
mov dword [ebp - 0x64], 0x803a8031
mov dword [ebp - 0x60], 0x807b8020
mov dword [ebp - 0x5c], 0x8000807d
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x1e
lea edx, [ebp - 0x1ec]
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x128]
or eax, 0x40
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.004177d0
add esp, 4
mov dword [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x1dc]
or ecx, 0x80
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1e0], ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.0043a3c0
mov dword [ebp - 4], 0x20
lea esi, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x100
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x1dc], eax
cmovae esi, dword [ebp - 0x30]
mov dword [ebp - 0x1e0], eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test eax, 0x100
je 0x473b19
and eax, 0xfffffeff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test al, al
jns 0x473b39
and eax, 0xffffff7f
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test al, 0x40
je 0x473b55
and eax, 0xffffffbf
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x473c65
xor eax, eax
mov dword [ebp - 0x7c], 0x80738055
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x80728065
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x74], 0x80538020
mov dword [ebp - 0x70], 0x80728074
mov dword [ebp - 0x6c], 0x80618065
mov dword [ebp - 0x68], 0x8020806d
mov dword [ebp - 0x64], 0x803a8032
mov dword [ebp - 0x60], 0x807b8020
mov dword [ebp - 0x5c], 0x8000807d
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x21
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 0x1dc]
lea ecx, [ebp - 0x128]
or eax, 0x200
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x204]
push eax
call fcn.004177d0
add esp, 4
mov dword [ebp - 4], 0x22
mov ecx, dword [ebp - 0x1dc]
or ecx, 0x400
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 0x1e0], ecx
lea ecx, [ebp - 0x30]
push eax
call fcn.0043a3c0
mov dword [ebp - 4], 0x23
lea esi, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x800
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x1dc], eax
cmovae esi, dword [ebp - 0x30]
mov dword [ebp - 0x1e0], eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test eax, 0x800
je 0x473c8b
and eax, 0xfffff7ff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test eax, 0x400
je 0x473cae
and eax, 0xfffffbff
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test eax, 0x200
je 0x473ccf
and eax, 0xfffffdff
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x473e3e
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x88], 0x80738055
mov dword [ebp - 0x84], 0x80728065
mov dword [ebp - 0x80], 0x80538020
mov esi, dword [eax + 0x34d8]
sub esi, dword [eax + 0x34d4]
mov dword [ebp - 0x7c], 0x80728074
mov dword [ebp - 0x78], 0x80618065
mov dword [ebp - 0x74], 0x8020806d
mov dword [ebp - 0x70], 0x80208033
mov dword [ebp - 0x6c], 0x80698073
mov dword [ebp - 0x68], 0x8065807a
mov dword [ebp - 0x64], 0x8020803a
mov dword [ebp - 0x60], 0x807d807b
mov dword [ebp - 0x5c], 0x8000
call fcn.00416fb0
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x1dc]
or eax, 0x1000
mov dword [ebp - 0x1d0], esi
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1dc], eax
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1cc], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473d96
sub ecx, esi
sub esp, 0x10
mov eax, esp
sar ecx, 1
lea esi, [ebp - 0x1d0]
push ecx
push edx
lea ecx, [ebp - 0x128]
mov dword [eax], 2
mov dword [eax + 4], 0
mov dword [eax + 8], esi
call fcn.0041d9e0
add esp, 0x18
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x2000
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043a3c0
mov dword [ebp - 4], 0x26
lea esi, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x4000
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x1dc], eax
cmovae esi, dword [ebp - 0x30]
mov dword [ebp - 0x1e0], eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test eax, 0x4000
je 0x473e64
and eax, 0xffffbfff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test eax, 0x2000
je 0x473e87
and eax, 0xffffdfff
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test eax, 0x1000
je 0x473ea8
and eax, 0xffffefff
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x474018
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x88], 0x80738055
mov dword [ebp - 0x84], 0x80728065
mov dword [ebp - 0x80], 0x80538020
mov esi, dword [eax + 0x10]
sub esi, dword [eax + 0xc]
mov dword [ebp - 0x7c], 0x80728074
mov dword [ebp - 0x78], 0x80618065
mov dword [ebp - 0x74], 0x8020806d
mov dword [ebp - 0x70], 0x80208034
mov dword [ebp - 0x6c], 0x80698073
mov dword [ebp - 0x68], 0x8065807a
mov dword [ebp - 0x64], 0x8020803a
mov dword [ebp - 0x60], 0x807d807b
mov dword [ebp - 0x5c], 0x8000
call fcn.00416fb0
mov byte [ebp - 4], 0x27
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x1dc]
or eax, 0x8000
mov dword [ebp - 0x1d8], esi
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1dc], eax
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1d4], eax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473f70
sub ecx, esi
sub esp, 0x10
mov eax, esp
sar ecx, 1
lea esi, [ebp - 0x1d8]
push ecx
push edx
lea ecx, [ebp - 0x128]
mov dword [eax], 2
mov dword [eax + 4], 0
mov dword [eax + 8], esi
call fcn.0041d9e0
add esp, 0x18
mov dword [ebp - 4], 0x28
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x10000
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043a3c0
mov dword [ebp - 4], 0x29
lea esi, [ebp - 0x30]
mov eax, dword [ebp - 0x1dc]
or eax, 0x20000
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x1dc], eax
cmovae esi, dword [ebp - 0x30]
mov dword [ebp - 0x1e0], eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
mov eax, dword [ebp - 0x1dc]
test eax, 0x20000
je 0x47403e
and eax, 0xfffdffff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
test eax, 0x10000
je 0x474061
and eax, 0xfffeffff
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 4], 0xe
test eax, 0x8000
je 0x474082
and eax, 0xffff7fff
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1dc], eax
call fcn.0043b020
mov dword [ebp - 0x160], 0x11171
lea ecx, [edi + 2]
mov dword [ebp - 0x158], edi
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x474095
sub edi, ecx
mov dword [ebp - 0x154], 0x11172
mov ecx, dword [ebp - 0x1f8]
sar edi, 1
mov dword [ebp - 0x14c], ecx
lea edx, [ecx + 2]
lea eax, [edi*2 + 2]
mov dword [ebp - 0x15c], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4740d0
sub ecx, edx
mov dword [ebp - 0x148], 0x11173
mov edx, dword [ebp - 0x1fc]
sar ecx, 1
mov dword [ebp - 0x13c], 0x10001
lea eax, [ecx*2 + 2]
mov ecx, dword [edx + 0x34d4]
mov dword [ebp - 0x150], eax
mov eax, dword [edx + 0x34d8]
sub eax, ecx
mov dword [ebp - 0x140], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x144], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
sub eax, ecx
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x138], eax
mov eax, dword [edx + 0x34fc]
push ecx
lea ecx, [ebp - 0x218]
push ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x240]
push ecx
push dword [ebp - 0x208]
mov ecx, dword [ebp - 0x200]
push dword [ecx]
push dword [eax + 0x19900]
push dword [eax + 0x19904]
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
jne 0x4748f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x19c], 8
lea esi, [ebp - 0x1b0]
lea edx, [ebp - 0xc0]
mov dword [ebp - 0xc0], 0x80728045
cmovae esi, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x4c]
mov edi, eax
mov dword [ebp - 0xbc], 0x806f8072
mov dword [ebp - 0xb8], 0x802c8072
mov dword [ebp - 0xb4], 0x80638020
mov dword [ebp - 0xb0], 0x806c8061
mov dword [ebp - 0xac], 0x8069806c
mov dword [ebp - 0xa8], 0x8067806e
mov dword [ebp - 0xa4], 0x804d8020
mov dword [ebp - 0xa0], 0x806e8069
mov dword [ebp - 0x9c], 0x80448069
mov dword [ebp - 0x98], 0x806d8075
mov dword [ebp - 0x94], 0x80578070
mov dword [ebp - 0x90], 0x80698072
mov dword [ebp - 0x8c], 0x80658074
mov dword [ebp - 0x88], 0x80758044
mov dword [ebp - 0x84], 0x8070806d
mov dword [ebp - 0x80], 0x8020803a
mov dword [ebp - 0x7c], 0x807d807b
mov dword [ebp - 0x78], 0x8020802c
mov dword [ebp - 0x74], 0x806f8066
mov dword [ebp - 0x70], 0x80208072
mov dword [ebp - 0x6c], 0x80698066
mov dword [ebp - 0x68], 0x8065806c
mov dword [ebp - 0x64], 0x8020803a
mov dword [ebp - 0x60], 0x807d807b
mov dword [ebp - 0x5c], 0x8000
call fcn.00416fb0
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x20c]
cmovae edx, dword [ebp - 0x4c]
mov ecx, edx
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xdc], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4742c1
sub ecx, esi
sub esp, 0x10
mov eax, esp
sar ecx, 1
lea esi, [ebp - 0xe8]
push ecx
push edx
lea ecx, [ebp - 0x128]
mov dword [eax], 0xc1
mov dword [eax + 4], 0
mov dword [eax + 8], esi
call fcn.0041d9e0
add esp, 0x18
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0x30]
call fcn.0043a3c0
mov byte [ebp - 4], 0x2f
lea esi, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043b020
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call fcn.0043b020
push 0
push 0
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x1f4], 0
push eax
push 0
push edi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x474479
xor eax, eax
mov dword [ebp - 0x84], 0x80728045
lea edx, [ebp - 0x84]
mov dword [ebp - 0x80], 0x806f8072
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x7c], 0x80208072
mov dword [ebp - 0x78], 0x80658064
mov dword [ebp - 0x74], 0x80638073
mov dword [ebp - 0x70], 0x80698072
mov dword [ebp - 0x6c], 0x80748070
mov dword [ebp - 0x68], 0x806f8069
mov dword [ebp - 0x64], 0x803a806e
mov dword [ebp - 0x60], 0x807b8020
mov dword [ebp - 0x5c], 0x8000807d
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x1f4]
push eax
call fcn.004177d0
add esp, 4
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x31
call fcn.0043a3c0
mov byte [ebp - 4], 0x32
lea esi, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043b020
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call fcn.0043b020
push dword [ebp - 0x1f4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4745cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0xb0]
mov dword [ebp - 0x1e4], eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0xb0], 0x80728045
mov dword [ebp - 0xac], 0x806f8072
mov dword [ebp - 0xa8], 0x802c8072
mov dword [ebp - 0xa4], 0x80638020
mov dword [ebp - 0xa0], 0x806c8061
mov dword [ebp - 0x9c], 0x8069806c
mov dword [ebp - 0x98], 0x8067806e
mov dword [ebp - 0x94], 0x80468020
mov dword [ebp - 0x90], 0x8072806f
mov dword [ebp - 0x8c], 0x8061806d
mov dword [ebp - 0x88], 0x804d8074
mov dword [ebp - 0x84], 0x80738065
mov dword [ebp - 0x80], 0x80618073
mov dword [ebp - 0x7c], 0x80658067
mov dword [ebp - 0x78], 0x80208057
mov dword [ebp - 0x74], 0x80618066
mov dword [ebp - 0x70], 0x806c8069
mov dword [ebp - 0x6c], 0x80648065
mov dword [ebp - 0x68], 0x8020803a
mov dword [ebp - 0x64], 0x807d807b
mov dword [ebp - 0x60], 0x8000
call fcn.00416fb0
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.00417e30
add esp, 4
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x34
call fcn.0043a3c0
mov byte [ebp - 4], 0x35
lea esi, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043b020
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call fcn.0043b020
mov al, byte [ebp - 0x1e5]
inc al
mov byte [ebp - 0x1e5], al
cmp edi, 0x800704c7
je 0x4745ef
cmp edi, 0xd000000d
jne 0x474780
cmp al, 0xa
jae 0x474780
jmp 0x4736a0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
test edi, edi
jle 0x474613
movzx edi, di
or edi, 0x80070000
call esi
movaps xmm0, xmmword [0x51b000]
lea edx, [ebp - 0xf8]
movups xmmword [ebp - 0xf8], xmm0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
movaps xmm0, xmmword [0x51afb0]
movups xmmword [ebp - 0xe8], xmm0
mov byte [ebp - 0xd8], 0
call fcn.00416c70
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 0x10
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.0047f750
add esp, 4
mov byte [ebp - 4], 0x19
cmp dword [eax + 0x14], 0x10
jb 0x474688
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0043b080
mov byte [ebp - 4], 0x1a
jmp 0x47473e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
test edi, edi
jle 0x4746b2
movzx edi, di
or edi, 0x80070000
call esi
movaps xmm0, xmmword [0x51b000]
lea edx, [ebp - 0xf8]
movups xmmword [ebp - 0xf8], xmm0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
movaps xmm0, xmmword [0x51b0f0]
movups xmmword [ebp - 0xe8], xmm0
mov word [ebp - 0xd8], 0x80fd
mov byte [ebp - 0xd6], 0
call fcn.00416c70
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 0x10
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.0047f750
add esp, 4
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0x10
jb 0x474730
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0043b080
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x1c], 8
lea esi, [ebp - 0x30]
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043a130
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call fcn.0043a130
cmp edi, 0xb7
jne 0x474855
xor eax, eax
mov dword [ebp - 0x7c], 0x804f804e
lea edx, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x80448020
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x74], 0x80538049
mov dword [ebp - 0x70], 0x8020804b
mov dword [ebp - 0x6c], 0x80508053
mov dword [ebp - 0x68], 0x80438041
mov dword [ebp - 0x64], 0x80208045
mov dword [ebp - 0x60], 0x80218021
mov dword [ebp - 0x5c], 0x80008021
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
call fcn.00417750
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x37
call fcn.0043a3c0
mov byte [ebp - 4], 0x38
lea esi, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043b020
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call fcn.0043b020
lea edx, [ebp - 0xf8]
mov dword [ebp - 0xf8], 0x80728057
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0xf4], 0x80748069
mov dword [ebp - 0xf0], 0x80448065
mov dword [ebp - 0xec], 0x806d8075
mov dword [ebp - 0xe8], 0x80208070
mov dword [ebp - 0xe4], 0x80618066
mov dword [ebp - 0xe0], 0x806c8069
mov dword [ebp - 0xdc], 0x80648065
mov dword [ebp - 0xd8], 0x8000
call fcn.00416fb0
mov byte [ebp - 4], 0x39
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1e4], eax
call fcn.00417750
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3a
call fcn.0043a3c0
mov byte [ebp - 4], 0x3b
jmp 0x474c3f
call fcn.00433fc0
mov eax, dword [eax]
cmp dword [eax], 0
je 0x474a0c
xor eax, eax
mov dword [ebp - 0x8c], 0x8069804d
lea edx, [ebp - 0x8c]
mov dword [ebp - 0x88], 0x8069806e
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x84], 0x80758044
mov dword [ebp - 0x80], 0x8070806d
mov dword [ebp - 0x7c], 0x80728057
mov dword [ebp - 0x78], 0x80748069
mov dword [ebp - 0x74], 0x80448065
mov dword [ebp - 0x70], 0x806d8075
mov dword [ebp - 0x6c], 0x80208070
mov dword [ebp - 0x68], 0x80758073
mov dword [ebp - 0x64], 0x80638063
mov dword [ebp - 0x60], 0x80738065
mov dword [ebp - 0x5c], 0x80008073
mov word [ebp - 0x58], ax
call fcn.00416fb0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x30]
mov edi, dword [ebp - 0x1dc]
or edi, 0x40000
mov dword [ebp - 0x1e0], edi
call fcn.0043b1c0
lea edx, [ebp - 0x1e4]
mov dword [ebp - 0x1e4], eax
lea ecx, [ebp - 0x4c]
call fcn.00417750
mov dword [ebp - 4], 0x2b
lea ecx, [ebp - 0x128]
or edi, 0x80000
push eax
mov dword [ebp - 0x1e0], edi
call fcn.0043a3c0
mov dword [ebp - 4], 0x2c
lea ecx, [ebp - 0x128]
or edi, 0x100000
mov dword [ebp - 0x1e0], edi
call fcn.0043b1c0
mov esi, eax
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 0
push eax
call fcn.00436d10
add esp, 0x14
jmp 0x474a12
mov edi, dword [ebp - 0x1dc]
test edi, 0x100000
je 0x474a2b
lea ecx, [ebp - 0x128]
and edi, 0xffefffff
call fcn.0043b020
test edi, 0x80000
je 0x474a41
lea ecx, [ebp - 0x4c]
and edi, 0xfff7ffff
call fcn.0043b020
mov dword [ebp - 4], 0xe
test edi, 0x40000
je 0x474a58
lea ecx, [ebp - 0x30]
call fcn.0043b020
cmp byte [ebp - 0x1ed], 0
mov eax, 0x1ab38
mov ecx, dword [ebp - 0x200]
mov esi, 0x1bd50
cmove esi, eax
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax + 0x34fc]
add esi, dword [eax]
mov eax, dword [ecx]
mov dword [esi], eax
mov ecx, dword [ecx]
call fcn.004696d0
mov dword [esi + 0x1210], eax
lea eax, [ebp - 0x110]
mov dword [esi + 0x1214], edx
cmp dword [ebp - 0xfc], 8
cmovae eax, dword [ebp - 0x110]
push eax
lea eax, [esi + 0x1004]
push 0x104
push eax
call fcn.004dd3fa
add esp, 0xc
lea eax, [ebp - 0x1b0]
cmp dword [ebp - 0x19c], 8
cmovae eax, dword [ebp - 0x1b0]
push eax
lea eax, [esi + 4]
push 0x800
push eax
call fcn.004dd3fa
add esp, 0xc
mov byte [ebp - 0x1e5], 1
jmp 0x474c84
cmp dword [ebp - 0x19c], 8
lea eax, [ebp - 0x1b0]
cmovae eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1e4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1ec], eax
lea edx, [ebp - 0x180]
xor eax, eax
mov dword [ebp - 0x180], 0x80728045
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x17c], 0x806f8072
mov dword [ebp - 0x178], 0x802c8072
mov dword [ebp - 0x174], 0x80638020
mov dword [ebp - 0x170], 0x806c8061
mov dword [ebp - 0x16c], 0x8069806c
mov dword [ebp - 0x168], 0x8067806e
mov dword [ebp - 0x164], 0x804e8020
mov dword [ebp - 0x160], 0x80438074
mov dword [ebp - 0x15c], 0x80658072
mov dword [ebp - 0x158], 0x80748061
mov dword [ebp - 0x154], 0x80468065
mov dword [ebp - 0x150], 0x806c8069
mov dword [ebp - 0x14c], 0x803a8065
mov dword [ebp - 0x148], 0x807b8020
mov dword [ebp - 0x144], 0x8020807d
mov dword [ebp - 0x140], 0x806f8066
mov dword [ebp - 0x13c], 0x803a8072
mov dword [ebp - 0x138], 0x807b8020
mov dword [ebp - 0x134], 0x8000807d
mov word [ebp - 0x130], ax
call fcn.00416fb0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x128]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x204], eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.00466720
add esp, 8
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x10
call fcn.0043a3c0
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x1c], 8
lea esi, [ebp - 0x30]
cmovae esi, dword [ebp - 0x30]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
add esp, 0x14
lea ecx, [ebp - 0x30]
call fcn.0043b020
lea ecx, [ebp - 0x128]
call fcn.0043b020
lea ecx, [ebp - 0x4c]
call fcn.0043b020
mov byte [ebp - 0x1e5], 0
lea ecx, [ebp - 0x1b0]
call fcn.0043b020
mov ecx, dword [ebp - 0xfc]
cmp ecx, 8
jb 0x474cad
inc ecx
push ecx
push dword [ebp - 0x110]
lea ecx, [ebp - 0x110]
call fcn.0043afe0
mov al, byte [ebp - 0x1e5]
jmp 0x474eea
xor eax, eax
mov dword [ebp - 0x178], 0x80728045
lea edx, [ebp - 0x178]
mov dword [ebp - 0x174], 0x806f8072
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x170], 0x802c8072
mov dword [ebp - 0x16c], 0x80698020
mov dword [ebp - 0x168], 0x8076806e
mov dword [ebp - 0x164], 0x806c8061
mov dword [ebp - 0x160], 0x80648069
mov dword [ebp - 0x15c], 0x80648020
mov dword [ebp - 0x158], 0x806d8075
mov dword [ebp - 0x154], 0x80208070
mov dword [ebp - 0x150], 0x806f8066
mov dword [ebp - 0x14c], 0x8064806c
mov dword [ebp - 0x148], 0x80728065
mov dword [ebp - 0x144], 0x80688020
mov dword [ebp - 0x140], 0x806e8061
mov dword [ebp - 0x13c], 0x806c8064
mov dword [ebp - 0x138], 0x80008065
mov word [ebp - 0x134], ax
call fcn.00416fb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x198]
cmp dword [ebp - 0x184], 8
lea edx, [ebp - 0x1e4]
lea ecx, [ebp - 0x1c8]
cmovae eax, dword [ebp - 0x198]
mov dword [ebp - 0x1e4], eax
call fcn.00417750
push eax
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 1
call fcn.0043a3c0
mov byte [ebp - 4], 2
lea esi, [ebp - 0xec]
cmp dword [ebp - 0xd8], 8
cmovae esi, dword [ebp - 0xec]
call fcn.00433fc0
push esi
push 0
push str._BDREINIT__::_CReinitProcess::WriteDump____
push 8
push eax
call fcn.00436d10
mov edx, dword [ebp - 0xd8]
add esp, 0x14
cmp edx, 8
jb 0x474e2e
mov ecx, dword [ebp - 0xec]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x474e24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474fa2
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x1b4]
xor eax, eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 7
mov word [ebp - 0xec], ax
cmp edx, 8
jb 0x474e8b
mov ecx, dword [ebp - 0x1c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x474e81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474fa2
push edx
push ecx
call fcn.004cb66f
add esp, 8
mov edx, dword [ebp - 0x184]
xor eax, eax
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 7
mov word [ebp - 0x1c8], ax
cmp edx, 8
jb 0x474ee8
mov ecx, dword [ebp - 0x198]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x474ede
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474fa2
push edx
push ecx
call fcn.004cb66f
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.004d05ef
call fcn.004d05ef
call fcn.004d05ef
push 0x53935c
call fcn.004cb7e5
add esp, 4
cmp dword [0x53935c], 0xffffffff
jne 0x473466
mov eax, dword [0x539364]
cmp eax, dword [edi + 4]
jle 0x474f75
push 0x539364
call fcn.004cb7e5
add esp, 4
cmp dword [0x539364], 0xffffffff
jne 0x474f75
push 0x515d34
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x539364
mov dword [0x539368], eax
call fcn.004cb79b
add esp, 4
jmp 0x474f75
push str.NtCreateFile
push dword [0x539368]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x53935c
mov dword [0x539360], eax
call fcn.004cb79b
add esp, 4
jmp 0x473466
call fcn.0043abf0
call fcn.004d05ef
int3