Function at 0x47bbc0
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x540
call 0x47bbd4
pop eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [edx + 0x4c]
mov dword [esp + 4], edx
mov dword [esp + 0x18], eax
movzx eax, byte [edx + 0x50]
test al, al
jne 0x47bc17
test ecx, ecx
jne 0x47bc17
mov dword [esp + 0x118], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 4]
mov esi, dword [eax + 0x20]
test esi, esi
jne 0x47c51d
jmp 0x47c570
test al, al
mov dword [esp + 0xd8], 0
mov dword [esp], ecx
mov dword [esp + 0xe0], 0
jne 0x47bd8e
call fcn.0045ae80
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
nop word cs:[eax + eax]
nop
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x140]
push eax
call fcn.00478db0
add esp, 8
mov edi, dword [esp + 0x13c]
cmp edi, 0x80000000
je 0x47bd85
mov ecx, dword [esp + 0x14c]
movq xmm0, qword [esp + 0x144]
mov ebx, dword [esp + 0x140]
mov esi, dword [esp + 0x154]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x150]
movd eax, xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0xb0], ebx
add eax, ebx
mov dword [esp + 0xb4], eax
mov word [esp + 0xb8], 0
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x50]
lea edx, [esp + 0xb0]
call fcn.0044f8f0
movaps xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0xf4]
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], ebx
movlps qword [esp + 0xec], xmm0
mov dword [ecx + 8], eax
mov eax, dword [esp + 8]
movq xmm0, qword [esp + 0x50]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xc]
movq qword [ecx], xmm0
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], eax
lea edx, [esp + 0xd8]
lea eax, [esp + 0xb0]
lea ecx, [esp + 0x50]
push eax
lea eax, [esp + 0xe8]
push eax
call fcn.0043e8d0
add esp, 8
mov eax, dword [esp + 0x50]
test eax, 0x7fffffff
je 0x47bc50
push 1
push eax
push dword [esp + 0x5c]
call fcn.00401c20
add esp, 0xc
jmp 0x47bc50
push dword [esp + 0x40]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov ecx, dword [esp + 4]
mov esi, dword [esp]
xor edx, edx
mov eax, dword [ecx + 0x44]
mov ecx, dword [ecx + 0x48]
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], esi
nop dword [eax]
lea ecx, [esp + 0xb0]
call fcn.00439520
mov ebx, eax
test eax, eax
je 0x47c34d
cmp dword [edx], 0x80000000
mov edi, edx
jne 0x47bf70
mov esi, dword [esp + 0xd8]
test esi, esi
je 0x47bdf0
mov edi, dword [esp + 0xdc]
mov edx, esi
lea ecx, [esp + 0x50]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push edi
call fcn.00442a70
add esp, 0xc
cmp dword [esp + 0x50], 0
jne 0x47bdf0
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x5c]
mov byte [esp + 0x12c], 0
test ecx, ecx
jne 0x47bea7
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], edx
lea edx, [esp + 0xe4]
lea eax, [esp + 0x12c]
lea ecx, [esp + 0x13c]
push eax
call fcn.004421d0
add esp, 4
jmp 0x47c272
movzx edx, word [eax + 0x1ea]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
jne 0x47bea0
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
dec ecx
mov dword [esp + 0x48], ecx
lea edx, [esp + 0x40]
lea eax, [esp + 0x12c]
lea ecx, [esp + 0x13c]
push eax
call fcn.004421d0
add esp, 4
movsd xmm2, qword [esp + 0x154]
movsd xmm1, qword [esp + 0x14c]
mov eax, dword [esp + 0x164]
movq xmm0, qword [esp + 0x15c]
mov edx, dword [esp + 0x168]
mov ecx, dword [esp + 0x170]
movsd qword [esp + 0xfc], xmm2
movsd qword [esp + 0xf4], xmm1
movsd xmm2, qword [esp + 0x13c]
movsd xmm1, qword [esp + 0x144]
mov dword [esp + 0x10c], eax
movq qword [esp + 0x104], xmm0
movsd qword [esp + 0xec], xmm1
movsd qword [esp + 0xe4], xmm2
movzx eax, word [edx + 0x1ea]
cmp ecx, eax
jae 0x47c11c
mov eax, edx
jmp 0x47c153
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
test eax, eax
mov dword [esp + 8], eax
je 0x47bfac
mov dword [esp + 0xc], ecx
js 0x47eaf3
mov eax, dword [0x4f92d8]
movzx eax, byte [eax]
push 1
mov esi, dword [esp + 0xc]
push esi
call fcn.00401c10
add esp, 8
mov ecx, dword [esp + 0xc]
test eax, eax
jne 0x47bfb5
jmp 0x47eae3
mov esi, dword [esp + 8]
mov eax, 1
push esi
push ecx
mov dword [esp + 0x14], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, byte [ebx + 0xc]
mov esi, dword [ebx + 0x18]
mov dword [esp + 0x14], edi
mov byte [esp + 0x20], al
mov eax, dword [ebx + 0x14]
test esi, esi
je 0x47c015
cmp esi, 0x3fffffff
mov dword [esp], eax
ja 0x47eafd
mov ebx, esi
add ebx, esi
js 0x47eafd
mov eax, dword [0x4f92d8]
movzx eax, byte [eax]
push 2
push ebx
call fcn.00401c10
add esp, 8
test eax, eax
je 0x47eb07
mov edi, eax
mov eax, dword [esp]
jmp 0x47c01c
mov edi, 2
xor ebx, ebx
push ebx
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], edi
mov dword [esp], esi
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], eax
movzx eax, byte [esp + 0x20]
mov byte [esp + 0x148], al
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x154], esi
mov ebx, dword [edi + 8]
mov eax, dword [edi + 4]
test ebx, ebx
je 0x47c0a6
mov dword [esp + 0x20], eax
js 0x47ead9
mov eax, dword [0x4f92d8]
movzx eax, byte [eax]
push 1
push ebx
call fcn.00401c10
add esp, 8
mov esi, eax
test eax, eax
mov eax, dword [esp + 0x20]
jne 0x47c0ab
jmp 0x47eb17
mov esi, 1
push ebx
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, byte [edi + 0xc]
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], ebx
mov byte [esp + 0xf0], al
lea edx, [esp + 0xd8]
lea eax, [esp + 0xe4]
lea ecx, [esp + 0x50]
push eax
lea eax, [esp + 0x140]
push eax
call fcn.0043e8d0
add esp, 8
mov eax, dword [esp + 0x50]
test eax, 0x7fffffff
je 0x47bdf0
push 1
push eax
push dword [esp + 0x5c]
call fcn.00401c20
add esp, 0xc
jmp 0x47bdf0
mov ebx, dword [esp + 0x16c]
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x47c14f
movzx ecx, word [edx + 0x1e8]
inc ebx
mov edx, eax
cmp cx, word [eax + 0x1ea]
jae 0x47c130
jmp 0x47c153
xor eax, eax
mov ecx, ebx
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov ebx, dword [eax + edx + 0xcc]
mov dword [esp + 0x84], ebx
mov ebx, dword [esp + 0xfc]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x7c], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x74], xmm1
movsd qword [esp + 0x6c], xmm0
mov dword [eax + edx + 0xcc], ebx
lea ebx, [esp + 0x100]
movsd xmm0, qword [esp + 0xf4]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0xe4]
movsd xmm1, qword [esp + 0xec]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x88]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
movsd qword [eax + ecx], xmm0
movsd qword [eax + ecx + 8], xmm1
movsd xmm2, qword [esp + 0x84]
movsd xmm1, qword [esp + 0x7c]
mov eax, dword [esp + 0x94]
movq xmm0, qword [esp + 0x8c]
movsd qword [esp + 0x154], xmm2
movsd qword [esp + 0x14c], xmm1
movsd xmm2, qword [esp + 0x6c]
movsd xmm1, qword [esp + 0x74]
mov dword [esp + 0x164], eax
movq qword [esp + 0x15c], xmm0
movsd qword [esp + 0x144], xmm1
movsd qword [esp + 0x13c], xmm2
mov eax, dword [esp + 0x14c]
dec dword [esp + 0xe0]
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 0x13c]
mov ebx, dword [esp + 0x140]
cmp byte [esp + 0x12c], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x158]
mov dword [esp + 8], eax
je 0x47c2fb
test edi, edi
mov dword [esp + 0x20], ecx
je 0x47eb27
mov eax, dword [esi + 0x1ec]
dec edi
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edi
mov dword [eax + 0xb0], 0
push 4
push 0x21c
push esi
call fcn.00401c20
add esp, 0xc
mov ecx, dword [esp + 0x20]
cmp ecx, 0x80000000
je 0x47bdf0
test ecx, ecx
je 0x47c317
push 1
push ecx
push ebx
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47c330
add eax, eax
push 2
push eax
push dword [esp + 0x1c]
call fcn.00401c20
add esp, 0xc
test dword [esp + 8], 0x7fffffff
je 0x47bdf0
push 1
push dword [esp + 0xc]
push dword [esp + 8]
jmp 0x47c10f
mov eax, dword [esp + 0xe0]
movq xmm0, qword [esp + 0xd8]
mov dword [esp + 0x124], eax
mov eax, dword [0x4f92d8]
movq qword [esp + 0x11c], xmm0
mov dword [esp + 0x118], 1
movzx eax, byte [eax]
push 1
push 4
call fcn.00401c10
add esp, 8
test eax, eax
je 0x47eb40
mov esi, eax
mov dword [eax], 0x48544150
add eax, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], eax
mov word [esp + 0x74], 0
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x6c]
call fcn.0044f8f0
mov eax, dword [esp + 0xec]
movq xmm0, qword [esp + 0xe4]
mov dword [esp + 0x13c], 4
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], 4
mov byte [esp + 0x148], 0
mov dword [esp + 0x1c], esi
xor esi, esi
movq qword [esp + 0x14c], xmm0
mov dword [esp + 0x154], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x47c4e2
mov ecx, dword [esp + 0x120]
mov dword [esp], ecx
movzx edx, word [eax + 0x1ea]
lea ecx, [eax + 0xb4]
mov dword [esp + 0x20], eax
lea edi, [eax - 8]
mov esi, 0xffffffff
lea eax, [edx + edx*8]
mov dword [esp + 0x10], edx
lea ebx, [eax + eax*2]
add ebx, edx
nop word cs:[eax + eax]
test ebx, ebx
je 0x47c4a0
lea eax, [ecx + 0x1c]
mov dword [esp + 8], eax
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0x20]
push dword [esp + 0x1c]
call sub.kernel32.dll_CompareStringOrdinal
mov ecx, dword [esp + 8]
add edi, 0x10
inc esi
add ebx, 0xffffffe4
cmp eax, 3
je 0x47c460
cmp eax, 1
jne 0x47c4c3
jmp 0x47c4a4
mov esi, dword [esp + 0x10]
mov ecx, dword [esp]
mov eax, dword [esp + 0x20]
sub ecx, 1
jb 0x47c991
mov eax, dword [eax + esi*4 + 0x1ec]
mov dword [esp], ecx
jmp 0x47c431
cmp eax, 2
jne 0x47ea6a
cmp dword [esp + 0x20], 0
mov esi, 0
je 0x47c4e2
mov esi, dword [edi - 4]
mov eax, dword [edi]
mov dword [esp], eax
jmp 0x47c4e2
push 1
push 4
push dword [esp + 0x24]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x47c50e
add eax, eax
push 2
push eax
push dword [esp + 0x14]
call fcn.00401c20
add esp, 0xc
mov dword [esp + 0x20], esi
mov eax, dword [esp + 4]
mov esi, dword [eax + 0x20]
test esi, esi
je 0x47c570
mov eax, dword [esp + 4]
cmp esi, 4
mov edx, dword [eax + 0x1c]
mov eax, 0x4793d0
jb 0x47c551
mov eax, dword [edx]
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x4793d0
adc ecx, 0xffffffff
mov ecx, 0x4793f0
cmove eax, ecx
movzx ebx, byte [esi + edx - 1]
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
push ebx
call eax
add esp, 4
mov edi, dword [esp + 0xc]
test al, al
je 0x47c5fc
mov byte [esp + 0x44], 2
mov dword [esp + 0x48], 0x4e1888
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
mov dword [eax + 4], edi
mov dword [eax], esi
mov dword [eax + 8], 2
cmp dword [esp + 0x118], 0
je 0x47c69f
mov ecx, dword [esp + 0x11c]
test ecx, ecx
je 0x47c67a
mov edx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], ecx
mov dword [esp + 0x148], edx
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], ecx
mov ecx, 1
mov dword [esp + 0x158], edx
jmp 0x47c67e
xor eax, eax
cmp edi, 4
mov ecx, 0
jb 0x47c6c1
mov esi, dword [esp + 8]
movzx ecx, byte [edi + esi - 4]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x2e
jne 0x47c6b7
movzx ecx, byte [esi + edi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x47c6b7
movzx ecx, byte [esi + edi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x47c6bb
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x47c6bd
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x15c], eax
lea ecx, [esp + 0x13c]
call fcn.0043b2a0
mov eax, dword [ebp + 8]
cmp dword [eax], 4
jb 0x47c6af
push dword [eax + 4]
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x47c6c1
xor ecx, ecx
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 8]
add edx, edi
mov dword [esp + 0x14], edx
nop dword [eax + eax]
cmp edi, eax
je 0x47c739
mov edx, dword [esp + 8]
movzx edx, byte [edx + eax]
cmp edx, 0x5c
je 0x47c6e7
inc eax
cmp edx, 0x2f
jne 0x47c6d0
test cl, cl
je 0x47c801
mov edx, dword [esp + 8]
lea ecx, [esp + 0x13c]
push edi
call fcn.00481cb0
add esp, 4
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
cmp edx, 0x80000000
jne 0x47c8ec
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x40], 0x80000000
jmp 0x47cf4e
mov eax, dword [esp + 8]
xor esi, esi
jmp 0x47c75b
xor esi, esi
test cx, cx
je 0x47c8d7
mov cx, 1
test si, si
jne 0x47c750
cmp eax, dword [esp + 0x14]
je 0x47c92f
movzx ebx, byte [eax]
test bl, bl
js 0x47c77e
mov edi, dword [esp + 0xc]
inc eax
mov edx, ebx
jmp 0x47c7d1
movzx edi, byte [eax + 1]
mov edx, ebx
and edx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x47c7c5
movzx esi, byte [eax + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp bl, 0xf0
jb 0x47c7da
movzx edi, byte [eax + 3]
and edx, 7
shl esi, 6
add eax, 4
shl edx, 0x12
and edi, 0x3f
or edi, esi
or edx, edi
mov edi, dword [esp + 0xc]
cmp edx, 0xffff
jbe 0x47c7d1
jmp 0x47c7ee
shl edx, 6
add eax, 2
or edx, edi
mov edi, dword [esp + 0xc]
xor esi, esi
mov ecx, edx
jmp 0x47c752
shl edx, 0xc
add eax, 3
or edx, esi
mov edi, dword [esp + 0xc]
cmp edx, 0xffff
jbe 0x47c7d1
and edx, 0x3ff
or edx, 0xdc00
mov esi, edx
jmp 0x47c752
test edi, edi
js 0x47eb8a
mov eax, dword [0x4f92d8]
movzx eax, byte [eax]
push 1
push edi
call fcn.00401c10
add esp, 8
test eax, eax
je 0x47eb48
mov esi, eax
push edi
push dword [esp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x13c], edi
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], edi
mov byte [esp + 0x148], 0
lea eax, [esp + 0x13c]
push 4
push 0x4e1845
push eax
call fcn.00482e20
add esp, 0xc
mov eax, dword [esp + 0x13c]
mov esi, dword [esp + 0x140]
mov edi, dword [esp + 0x144]
mov dword [esp + 0xc], eax
mov edx, esi
lea ecx, [esp + 0x6c]
push edi
call fcn.0047f420
add esp, 4
cmp dword [esp + 0x6c], 0x80000000
jne 0x47c916
mov dword [esp + 0x20], edi
push edi
push esi
call fcn.0046ab90
add esp, 8
mov edi, eax
test eax, eax
je 0x47c988
mov ebx, edx
cmp edx, 2
jne 0x47c955
movzx eax, word [edi]
cmp eax, 0x2e2e
jne 0x47c955
mov ecx, 2
xor eax, eax
jmp 0x47ceb9
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 0x4e1838
jmp 0x47c57d
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], ecx
lea ecx, [esp + 0x40]
lea edx, [esp + 0x13c]
call fcn.00473970
jmp 0x47cf4e
mov eax, dword [esp + 0x74]
movq xmm0, qword [esp + 0x6c]
mov dword [esp + 0x48], eax
movq qword [esp + 0x40], xmm0
jmp 0x47cf3a
cmp edi, 7
ja 0x47c998
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 8]
xor eax, eax
nop
cmp byte [ecx + eax], 0x2e
je 0x47c9bc
inc eax
cmp edi, eax
jne 0x47c940
mov dword [esp + 0x1c], 0
jmp 0x47c9c4
xor ecx, ecx
mov eax, edi
mov dword [esp], esi
nop dword [eax]
cmp ebx, ecx
je 0x47c9b1
cmp byte [eax + ebx - 1], 0x2e
lea esi, [eax - 1]
mov edx, ecx
lea ecx, [ecx + 1]
mov eax, esi
jne 0x47c960
mov eax, ebx
sub eax, ecx
jne 0x47ceb0
xor eax, eax
mov ecx, ebx
jmp 0x47ceb6
mov ebx, dword [esp + 0x20]
jmp 0x47ced4
xor esi, esi
jmp 0x47c4e2
push edi
push dword [esp + 0xc]
push 0x2e
call fcn.004b9eb0
add esp, 0xc
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x20]
jmp 0x47c9c4
mov eax, edi
mov edx, ebx
xor edi, edi
jmp 0x47ceb6
mov dword [esp + 0x1c], 1
test edx, edx
je 0x47caf6
mov eax, dword [esp]
mov dword [esp + 0x6c], edx
add eax, edx
mov dword [esp + 0x70], eax
mov word [esp + 0x74], 0
mov byte [esp + 0x78], 1
lea eax, [esp + 0x6c]
lea esi, [esp + 0x13c]
push eax
push esi
call fcn.00478f40
add esp, 8
mov eax, dword [esp + 0x13c]
mov ebx, dword [esp + 0xc]
cmp eax, 0x80000000
je 0x47caf6
mov edx, dword [esp + 0x144]
mov ecx, dword [esp + 0x140]
test edx, edx
jne 0x47ca53
test eax, eax
je 0x47ca32
push 1
push eax
push ecx
call fcn.00401c20
add esp, 0xc
lea eax, [esp + 0x6c]
push eax
push esi
call fcn.00478f40
add esp, 8
mov eax, dword [esp + 0x13c]
cmp eax, 0x80000000
jne 0x47ca10
jmp 0x47caf6
mov edi, dword [esp + 0x148]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], edi
push ebx
push dword [esp + 0xc]
push esi
call fcn.00469b70
add esp, 0xc
cmp dword [esp + 0x1c], 1
je 0x47ca9b
push 3
push str.exe.NULexit_code:
push esi
call fcn.0046a670
add esp, 0xc
mov ebx, dword [esp + 0x140]
mov edx, ebx
lea ecx, [esp + 0xe4]
push dword [esp + 0x144]
call fcn.0047f420
add esp, 4
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x47cad1
push 1
push eax
push ebx
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xe4]
cmp eax, 0x80000000
jne 0x47cd5f
lea eax, [esp + 0x6c]
push eax
push esi
call fcn.00478f40
add esp, 8
jmp 0x47c9fa
lea ecx, [esp + 0x6c]
call fcn.00479170
mov esi, dword [esp + 0x6c]
cmp esi, 0x80000000
jne 0x47cb19
lea ecx, [esp + 0x6c]
call fcn.0043c7e0
jmp 0x47cbd4
mov eax, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x20], eax
push ebx
push edi
call fcn.0046aa60
add esp, 8
mov ecx, dword [esp + 0x20]
cmp ebx, edx
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], edi
cmovb edx, ebx
test eax, eax
cmove edx, ebx
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], ecx
lea esi, [esp + 0x13c]
push dword [esp + 0xc]
push dword [esp + 0xc]
push esi
call fcn.00469b70
add esp, 0xc
cmp dword [esp + 0x1c], 1
je 0x47cb8c
push 3
push str.exe.NULexit_code:
push esi
call fcn.0046a670
add esp, 0xc
mov esi, dword [esp + 0x140]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x144]
call fcn.0047f420
add esp, 4
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x47cbc2
push 1
push eax
push esi
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xe4]
cmp eax, 0x80000000
jne 0x47cd5f
mov esi, 0x200
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 2
mov dword [esp + 0xb8], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 2
cmp esi, 0x201
jb 0x47cc2e
jmp 0x47cc40
jbe 0x47ccd3
cmp esi, 0x201
jae 0x47cc40
mov dword [esp], 0x200
lea edi, [esp + 0x13c]
mov ebx, esi
jmp 0x47cc7e
mov ebx, dword [esp + 0x20]
sub esi, ebx
je 0x47cc6c
mov edx, ebx
lea ecx, [esp + 0xb0]
push esi
call fcn.00443bc0
add esp, 4
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x10]
mov dword [esp + 0xb8], ebx
mov dword [esp], ebx
mov dword [esp + 0x20], ebx
push 0
call sub.kernel32.dll_SetLastError
push ebx
push edi
call sub.kernel32.dll_GetSystemDirectoryW
mov esi, eax
test eax, eax
jne 0x47cc9f
call fcn.004c9ea0
test eax, eax
jne 0x47cd76
cmp esi, ebx
jne 0x47cc20
call fcn.004c9ea0
cmp eax, 0x7a
jne 0x47eb5b
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x47cc40
jmp 0x47cc2e
mov eax, dword [esp]
mov ebx, dword [esp + 0xc]
cmp esi, eax
ja 0x47eba7
push esi
push edi
lea esi, [esp + 0x74]
push esi
call fcn.00467d80
add esp, 0xc
push ebx
push dword [esp + 0xc]
push esi
call fcn.00469b70
add esp, 0xc
cmp dword [esp + 0x1c], 1
je 0x47cd16
push 3
push str.exe.NULexit_code:
push esi
call fcn.0046a670
add esp, 0xc
mov esi, dword [esp + 0x70]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x74]
call fcn.0047f420
add esp, 4
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x47cd43
push 1
push eax
push esi
call fcn.00401c20
add esp, 0xc
movq xmm0, qword [esp + 0xe4]
mov eax, dword [esp + 0xec]
movq qword [esp + 0x50], xmm0
mov dword [esp + 0x58], eax
jmp 0x47cd8c
mov esi, dword [esp + 0xe8]
mov edi, dword [esp + 0xec]
mov dword [esp + 0xc], eax
jmp 0x47cf69
call fcn.004c9ea0
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], 0x80000001
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47cda5
add eax, eax
push 2
push eax
push dword [esp + 0x18]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x50]
cmp eax, 0x80000001
jg 0x47dbe9
lea ecx, [esp + 0x50]
call fcn.0043b070
mov esi, 0x200
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 2
mov dword [esp + 0xb8], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], 2
cmp esi, 0x201
jb 0x47ce0b
jmp 0x47ce1d
jbe 0x47d918
cmp esi, 0x201
jae 0x47ce1d
mov dword [esp], 0x200
lea edi, [esp + 0x13c]
mov ebx, esi
jmp 0x47ce5b
mov ebx, dword [esp + 0x20]
sub esi, ebx
je 0x47ce49
mov edx, ebx
lea ecx, [esp + 0xb0]
push esi
call fcn.00443bc0
add esp, 4
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x10]
mov dword [esp + 0xb8], ebx
mov dword [esp], ebx
mov dword [esp + 0x20], ebx
push 0
call sub.kernel32.dll_SetLastError
push ebx
push edi
call sub.kernel32.dll_GetWindowsDirectoryW
mov esi, eax
test eax, eax
jne 0x47ce7c
call fcn.004c9ea0
test eax, eax
jne 0x47da2b
cmp esi, ebx
jne 0x47cdfd
call fcn.004c9ea0
cmp eax, 0x7a
jne 0x47eb74
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x47ce1d
jmp 0x47ce0b
mov ecx, eax
lea eax, [esi + ebx + 1]
mov esi, dword [esp]
mov ebx, dword [esp + 0x20]
test edi, edi
cmovne eax, edi
test eax, eax
je 0x47ced4
test edi, edi
cmove ecx, edx
add eax, ecx
sub eax, esi
cmp ebx, eax
cmovae ebx, eax
mov edx, esi
lea ecx, [esp + 0x13c]
push ebx
call fcn.00481cb0
add esp, 4
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
cmp edx, 0x80000000
jne 0x47cf15
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x40], 0x80000000
jmp 0x47cf3a
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], ecx
lea ecx, [esp + 0x40]
lea edx, [esp + 0x13c]
call fcn.00473970
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47cf4e
push 1
push eax
push esi
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
cmp eax, 0x80000000
mov dword [esp + 0xc], eax
je 0x47c585
cmp edi, 5
mov dword [esp + 0x20], esi
jb 0x47cf86
cmp word [esi + edi*2 - 0xa], 0x2e
jne 0x47cf86
cmp word [esi + edi*2 - 2], 0
je 0x47d6ef
mov eax, dword [esp + 4]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 2
mov dword [esp + 0x74], 0
mov ebx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
movzx eax, byte [eax + 0x65]
mov byte [esp], al
lea ecx, [esp + 0x6c]
xor edx, edx
call fcn.00443810
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edi, dword [esp + 0x14]
mov word [eax + ecx*2], 0x22
mov eax, dword [esp + 8]
inc ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], edi
mov word [esp + 0x144], 0
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x13c]
call fcn.0044f790
mov edx, dword [esp + 0x74]
cmp edx, dword [esp + 0x6c]
jne 0x47d014
lea ecx, [esp + 0x6c]
call fcn.00443810
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov word [eax + edx*2], 0x22
inc edx
test esi, esi
mov dword [esp + 0x74], edx
je 0x47d093
shl esi, 2
lea edi, [esi + esi*4]
movzx esi, byte [esp]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edx, dword [esp + 0x74]
cmp edx, dword [esp + 0x6c]
jne 0x47d057
lea ecx, [esp + 0x6c]
call fcn.00443810
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
mov word [eax + edx*2], 0x20
inc edx
mov dword [esp + 0x74], edx
lea edx, [esp + 0x6c]
lea ecx, [esp + 0xe4]
push esi
push ebx
call fcn.004734f0
add esp, 8
movzx eax, byte [esp + 0xe4]
cmp al, 4
jne 0x47d5c3
add ebx, 0x14
add edi, 0xffffffec
jne 0x47d040
mov edx, dword [esp + 0x6c]
mov edi, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
cmp edx, 0x80000000
je 0x47d60e
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov al, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 8], ebx
mov dword [esp + 0x14], ecx
cmp edx, esi
mov dword [esp + 0xd8], edx
mov dword [esp + 0xdc], edi
mov dword [esp + 0xe0], esi
jne 0x47d0f4
lea ecx, [esp + 0xd8]
call fcn.00443810
mov edi, dword [esp + 0xdc]
mov esi, dword [esp + 0xe0]
mov ecx, dword [esp + 4]
mov word [edi + esi*2], 0
inc esi
mov eax, 0x400
mov edx, 0x608
mov dword [esp + 0xe0], esi
cmp byte [ecx + 0x64], 0
cmove edx, eax
or edx, dword [ecx + 0x54]
cmp dword [esp + 0x118], 0
mov dword [esp + 0x128], edx
je 0x47d688
mov esi, dword [esp + 0x124]
mov edi, dword [esp + 0x11c]
mov ebx, dword [esp + 0x120]
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 2
mov dword [esp + 0xb8], 0
mov dword [esp + 0x10], 0
mov dword [esp], 2
mov dword [esp + 0x110], 0
test esi, esi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], esi
jne 0x47d1c8
mov al, 1
mov dword [esp], eax
lea ecx, [esp + 0xb0]
xor edx, edx
call fcn.00443810
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov word [eax + ecx*2], 0
inc ecx
mov dword [esp], eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0xb8], ecx
xor eax, eax
test edi, edi
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x13c]
setne al
cmove esi, edi
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], edi
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], edi
mov dword [esp + 0x158], ebx
mov ebx, dword [esp]
mov dword [esp + 0x15c], esi
xor esi, esi
call fcn.00440bb0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x47df37
mov ecx, dword [esp + 0x74]
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
mov edi, dword [eax + edx + 0xb4]
cmp edi, 0x80000000
mov dword [esp + 0x38], edi
je 0x47df37
mov edi, dword [eax + edx + 0xc4]
mov dword [esp + 0x138], esi
mov dword [esp], ebx
mov esi, dword [eax + edx + 0xb8]
mov ebx, dword [eax + edx + 0xbc]
shl ecx, 4
mov dword [esp + 0x4c], edi
mov edi, dword [eax + edx + 0xc8]
mov edx, dword [eax + edx + 0xcc]
mov dword [esp + 0x134], ebx
mov dword [esp + 0x60], esi
mov dword [esp + 0x114], edx
mov edx, dword [eax + ecx]
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edx
mov edx, dword [eax + ecx + 4]
mov eax, dword [eax + ecx + 8]
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], eax
lea eax, [esi + ebx]
xor ebx, ebx
mov edx, esi
mov dword [esp + 0xd4], eax
jmp 0x47d2db
xor ebx, ebx
test di, di
je 0x47d62d
mov di, 1
test bx, bx
jne 0x47d2d0
cmp edx, eax
je 0x47d37a
movzx ebx, byte [edx]
test bl, bl
js 0x47d2f8
inc edx
mov esi, ebx
jmp 0x47d34a
movzx ecx, byte [edx + 1]
mov esi, ebx
and esi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x47d342
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x47d350
movzx ecx, byte [edx + 3]
and esi, 7
shl eax, 6
add edx, 4
shl esi, 0x12
and ecx, 0x3f
or ecx, eax
or esi, ecx
mov eax, dword [esp + 0xd4]
cmp esi, 0xffff
jbe 0x47d34a
jmp 0x47d367
shl esi, 6
add edx, 2
or esi, ecx
xor ebx, ebx
mov edi, esi
jmp 0x47d2d2
shl esi, 0xc
add edx, 3
or esi, eax
mov eax, dword [esp + 0xd4]
cmp esi, 0xffff
jbe 0x47d34a
and esi, 0x3ff
or esi, 0xdc00
mov ebx, esi
jmp 0x47d2d2
mov eax, dword [esp + 0x38]
mov edx, dword [esp]
mov edi, dword [esp + 0x110]
mov ebx, dword [esp + 0x64]
test eax, eax
je 0x47d3ae
cmp eax, 0x80000000
je 0x47e875
mov esi, edx
push 1
push eax
push dword [esp + 0x68]
call fcn.00401c20
add esp, 0xc
mov edx, esi
mov eax, dword [esp + 0xb0]
mov esi, dword [esp + 0x114]
sub eax, edi
cmp eax, esi
jae 0x47d3e9
mov edx, edi
lea ecx, [esp + 0xb0]
push esi
call fcn.00443bc0
add esp, 4
mov edx, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
mov esi, dword [esp + 0x114]
lea eax, [esi + esi]
mov dword [esp], edx
lea ecx, [edx + edi*2]
push eax
push ebx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x4c]
add edi, esi
mov dword [esp + 0xb8], edi
test eax, eax
je 0x47d41c
add eax, eax
push 2
push eax
push ebx
call fcn.00401c20
add esp, 0xc
cmp edi, dword [esp + 0xb0]
jne 0x47d443
lea ecx, [esp + 0xb0]
mov edx, edi
call fcn.00443810
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
jmp 0x47d446
mov eax, dword [esp]
mov word [eax + edi*2], 0x3d
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
and dword [esp + 0x60], 0xffffff00
inc edi
mov dword [esp + 0xb8], edi
xor edi, edi
add eax, ecx
mov dword [esp], eax
jmp 0x47d478
xor edi, edi
test dx, dx
je 0x47d9a7
mov dx, 1
test di, di
jne 0x47d46d
cmp ecx, eax
je 0x47d50c
movzx ebx, byte [ecx]
test bl, bl
js 0x47d495
inc ecx
mov esi, ebx
jmp 0x47d503
movzx eax, byte [ecx + 1]
mov esi, ebx
and esi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x47d4d0
movzx edi, byte [ecx + 2]
shl eax, 6
and edi, 0x3f
or edi, eax
cmp bl, 0xf0
jb 0x47d4dd
movzx eax, byte [ecx + 3]
and esi, 7
shl edi, 6
add ecx, 4
shl esi, 0x12
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x47d4e5
shl esi, 6
add ecx, 2
or esi, eax
mov eax, dword [esp]
jmp 0x47d503
shl esi, 0xc
add ecx, 3
or esi, edi
mov eax, dword [esp]
cmp esi, 0xffff
jbe 0x47d503
and esi, 0x3ff
or esi, 0xdc00
mov edi, esi
jmp 0x47d46f
xor edi, edi
mov edx, esi
jmp 0x47d46f
mov esi, dword [esp + 0x68]
cmp esi, 0x80000000
je 0x47e959
mov eax, dword [esp + 0x34]
mov edi, dword [esp]
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], edi
mov word [esp + 0xec], 0
lea ecx, [esp + 0xb0]
lea edx, [esp + 0xe4]
call fcn.0044f790
test esi, esi
je 0x47d561
push 1
push esi
push dword [esp + 0x3c]
call fcn.00401c20
add esp, 0xc
mov edx, dword [esp + 0xb8]
cmp edx, dword [esp + 0xb0]
jne 0x47d584
lea ecx, [esp + 0xb0]
call fcn.00443810
mov edx, dword [esp + 0xb8]
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0xb4]
mov ecx, dword [esp + 0x60]
and eax, 0xffffff00
mov word [ebx + edx*2], 0
inc edx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x110], edx
mov dword [esp + 0xb8], edx
mov esi, eax
lea edx, [esp + 0x13c]
jmp 0x47d229
movzx ecx, byte [esp + 0xeb]
movzx esi, word [esp + 0xe9]
mov ebx, dword [esp + 0xe5]
shl ecx, 0x10
mov edi, ebx
or esi, ecx
movzx ecx, al
mov eax, dword [esp + 0x6c]
shl edi, 8
test eax, eax
je 0x47d608
add eax, eax
push 2
push eax
push dword [esp + 0x78]
mov dword [esp + 0x14], ecx
call fcn.00401c20
mov ecx, dword [esp + 0x14]
add esp, 0xc
shld esi, ebx, 8
or edi, ecx
mov eax, dword [esp + 0x3c]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 2
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
xor ebx, ebx
jmp 0x47e809
mov eax, dword [esp + 0x38]
test eax, eax
je 0x47d644
push 1
push eax
push dword [esp + 0x68]
call fcn.00401c20
add esp, 0xc
or dword [esp + 0x10], 2
mov eax, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
mov esi, 0x4e1838
test eax, eax
je 0x47d669
push 1
push eax
push dword [esp + 0x3c]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x47d67f
add eax, eax
push 2
push eax
push ebx
call fcn.00401c20
add esp, 0xc
mov dword [esp + 0x18], esi
jmp 0x47d9d4
mov edi, dword [esp + 0xc]
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], 2
mov eax, dword [esp + 4]
mov dword [esp], ebx
mov dword [esp + 0x18], esi
cmp dword [eax + 0x34], 0x80000000
jne 0x47d839
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x38], 2
pxor xmm0, xmm0
movdqu xmmword [esp + 0xb0], xmm0
push 0x51e118
call sub.kernel32.dll_AcquireSRWLockExclusive
mov eax, dword [0x51e0f4]
test eax, 0x7fffffff
je 0x47dbfa
call fcn.00471c00
xor al, 1
jmp 0x47dbfc
movzx eax, word [esi + edi*2 - 8]
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x47cf86
mov edx, dword [esp + 0x18]
add edx, dword [ecx*4 + 0x47f280]
jmp edx
mov edx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x34], edx
mov dword [esp + 0xd4], eax
jmp 0x47d85b
xor ebx, ebx
test si, si
je 0x47d8f5
mov si, 1
test bx, bx
jne 0x47d850
cmp edx, eax
je 0x47de97
movzx ebx, byte [edx]
test bl, bl
js 0x47d878
inc edx
mov edi, ebx
jmp 0x47d8e4
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x47d8b3
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x47d8bd
movzx ecx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, eax
or edi, ecx
jmp 0x47d8c5
shl edi, 6
add edx, 2
or edi, ecx
jmp 0x47d8e4
shl edi, 0xc
add edx, 3
or edi, eax
mov eax, dword [esp + 0xd4]
cmp edi, 0xffff
jbe 0x47d8e4
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x47d8e8
xor ebx, ebx
mov esi, edi
mov edi, dword [esp + 0xc]
test si, si
jne 0x47d85b
mov esi, dword [esp + 0x20]
mov edx, 0x4e1838
mov ecx, 2
mov eax, dword [esp + 0x3c]
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x47e7ab
mov eax, dword [esp]
mov ebx, dword [esp + 0xc]
cmp esi, eax
ja 0x47ebb8
push esi
push edi
lea edi, [esp + 0x74]
push edi
call fcn.00467d80
add esp, 0xc
push ebx
push dword [esp + 0xc]
push edi
call fcn.00469b70
add esp, 0xc
cmp dword [esp + 0x1c], 1
je 0x47d95b
push 3
push str.exe.NULexit_code:
push edi
call fcn.0046a670
add esp, 0xc
mov esi, dword [esp + 0x70]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x74]
call fcn.0047f420
add esp, 4
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x47d988
push 1
push eax
push esi
call fcn.00401c20
add esp, 0xc
movq xmm0, qword [esp + 0xe4]
mov eax, dword [esp + 0xec]
movq qword [esp + 0x50], xmm0
mov dword [esp + 0x58], eax
jmp 0x47da45
mov eax, dword [esp + 0x68]
test eax, eax
je 0x47d9be
push 1
push eax
push dword [esp + 0x3c]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x138]
mov dword [esp + 0x18], 0x4e1838
or eax, 2
mov dword [esp + 0x10], eax
mov dword [esp], 0
lea ecx, [esp + 0x13c]
call fcn.0043b2a0
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x47da06
add eax, eax
push 2
push eax
push dword [esp + 0xbc]
call fcn.00401c20
add esp, 0xc
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], 2
jmp 0x47e7c4
call fcn.004c9ea0
lea edi, [esp + 0x6c]
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], 0x80000001
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47da5e
add eax, eax
push 2
push eax
push dword [esp + 0x18]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x50]
cmp eax, 0x80000002
jge 0x47dbe9
lea ecx, [esp + 0x50]
call fcn.0043b070
lea eax, [esp + 0xe4]
push 4
push str.PATHlibrary_std_src_sys_commonprocess.rs
push eax
call fcn.0045b3c0
add esp, 0xc
mov eax, dword [esp + 0xe4]
cmp eax, 0x80000000
je 0x47de85
mov ecx, dword [esp + 0xe8]
mov edx, dword [esp + 0xec]
lea esi, [esp + 0x13c]
mov dword [esp + 0x20], eax
add edx, ecx
mov dword [esp + 0x6c], ecx
mov dword [esp], ecx
mov dword [esp + 0x70], edx
mov word [esp + 0x74], 0
mov byte [esp + 0x78], 1
mov ebx, dword [esp + 0xc]
push edi
push esi
call fcn.00478f40
add esp, 8
jmp 0x47daeb
push edi
push esi
call fcn.00478f40
add esp, 8
mov eax, dword [esp + 0x13c]
cmp eax, 0x80000000
je 0x47de6e
mov edx, dword [esp + 0x144]
mov ecx, dword [esp + 0x140]
test edx, edx
jne 0x47db21
test eax, eax
je 0x47dae1
push 1
push eax
push ecx
call fcn.00401c20
add esp, 0xc
jmp 0x47dae1
mov edi, dword [esp + 0x148]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], edx
mov dword [esp + 0x148], edi
push ebx
push dword [esp + 0xc]
push esi
call fcn.00469b70
add esp, 0xc
cmp dword [esp + 0x1c], 1
je 0x47db69
push 3
push str.exe.NULexit_code:
push esi
call fcn.0046a670
add esp, 0xc
mov ebx, dword [esp + 0x140]
mov edx, ebx
lea ecx, [esp + 0xb0]
push dword [esp + 0x144]
call fcn.0047f420
add esp, 4
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x47db9f
push 1
push eax
push ebx
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xb0]
lea edi, [esp + 0x6c]
cmp eax, 0x80000000
je 0x47dad1
mov esi, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
cmp dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
je 0x47cf69
push 1
push dword [esp + 0x24]
push dword [esp + 8]
call fcn.00401c20
add esp, 0xc
jmp 0x47cf69
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], eax
jmp 0x47cf69
xor eax, eax
movzx ecx, byte [0x51e11c]
mov dword [esp + 0x68], edi
test cl, cl
mov byte [esp + 0x34], cl
je 0x47dc1e
mov ecx, 1
mov dword [esp + 0x44], 0x51e118
jmp 0x47dc28
mov dword [esp + 0x44], 0x51e118
xor ecx, ecx
mov byte [esp + 0x48], al
mov dword [esp + 0xd4], eax
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 4]
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
lea edx, [esp + 0x12c]
mov dword [esp + 0xe4], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0x12c], 2
cmovne edx, eax
cmp dword [ecx], 6
lea edi, [ecx + 8]
lea esi, [ecx + 0x10]
cmovne edx, ecx
cmp dword [ecx + 8], 6
cmove edi, eax
cmp dword [ecx + 0x10], 6
cmove esi, eax
lea eax, [esp + 0xe4]
lea ecx, [esp + 0x13c]
push eax
push 0xfffffffffffffff6
call fcn.0047f4d0
add esp, 8
movzx eax, byte [esp + 0x13c]
cmp al, 4
jne 0x47ddfc
mov ecx, dword [esp + 0x140]
lea eax, [esp + 0xec]
mov dword [esp + 0x4c], ecx
mov edx, edi
lea ecx, [esp + 0x13c]
push eax
push 0xfffffffffffffff5
call fcn.0047f4d0
add esp, 8
movzx eax, byte [esp + 0x13c]
mov edi, dword [esp + 0xc]
cmp al, 4
jne 0x47de37
mov ecx, dword [esp + 0x140]
lea eax, [esp + 0xf4]
mov dword [esp + 0x64], ecx
mov edx, esi
lea ecx, [esp + 0x13c]
push eax
push 0xfffffffffffffff4
call fcn.0047f4d0
add esp, 8
movzx eax, byte [esp + 0x13c]
cmp al, 4
jne 0x47dfca
mov ecx, dword [esp + 0x140]
cmp dword [esp + 0x4c], 0
mov esi, dword [esp + 0x20]
pxor xmm0, xmm0
mov dword [esp + 0xac], 0
movdqu xmmword [esp + 0x9c], xmm0
movdqu xmmword [esp + 0x8c], xmm0
movdqu xmmword [esp + 0x7c], xmm0
movdqu xmmword [esp + 0x6c], xmm0
jne 0x47dd75
cmp dword [esp + 0x64], 0
jne 0x47dd75
test ecx, ecx
je 0x47dd9d
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x98], 0x100
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], ecx
mov edx, dword [esp + 4]
mov dword [esp + 0x60], ecx
mov eax, dword [edx + 0x60]
test eax, eax
mov dword [esp + 0x110], eax
je 0x47e526
add edx, 0x58
mov dword [esp + 0x6c], 0x48
lea ecx, [esp + 0x50]
call fcn.0047fce0
cmp dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x13c]
je 0x47e534
mov edx, eax
mov eax, dword [esp + 0x3c]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x47e6e1
movzx ecx, byte [esp + 0x13f]
mov edx, dword [esp + 0x3c]
movzx edi, word [esp + 0x13d]
mov esi, dword [esp + 0x140]
mov word [edx + 1], di
mov byte [edx + 3], cl
mov byte [edx], al
mov dword [edx + 4], esi
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov dword [edx + 8], 2
jmp 0x47e6fc
movzx ecx, byte [esp + 0x13f]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x140]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x13d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, dword [esp + 0x20]
mov dword [edx + 8], 2
jmp 0x47e6f3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47de85
push 1
push eax
push dword [esp + 8]
call fcn.00401c20
add esp, 0xc
mov byte [esp + 0x44], 2
mov dword [esp + 0x48], 0x4e185c
jmp 0x47c57d
mov esi, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], ecx
mov word [esp + 0x144], 0
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x13c]
call fcn.0044f8f0
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov esi, dword [esp + 0x20]
cmp edx, ecx
jne 0x47e001
lea ecx, [esp + 0x6c]
call fcn.00443810
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
jmp 0x47e003
mov dword [esp], 0
lea ecx, [esp + 0x13c]
call fcn.0043b2a0
mov edx, dword [esp + 0x110]
cmp edx, dword [esp + 0xb0]
jne 0x47df7b
mov dword [esp], 0
lea ecx, [esp + 0xb0]
call fcn.00443810
mov ebx, dword [esp + 0xb4]
mov edx, dword [esp + 0xb8]
mov word [ebx + edx*2], 0
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
cmp ecx, 0x80000000
mov dword [esp + 0x10], eax
jne 0x47e027
inc edx
mov dword [esp + 0x18], edx
jmp 0x47da0e
movzx ecx, byte [esp + 0x13f]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x140]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x13d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, dword [esp + 0x20]
mov dword [edx + 8], 2
jmp 0x47e6ea
mov eax, ecx
mov ecx, dword [esp + 0x70]
cmp eax, 0x80000000
mov word [ecx + edx*2], 0
jne 0x47e01a
inc edx
jmp 0x47d903
mov ebx, eax
mov dword [esp + 0x38], ecx
mov edi, ecx
jmp 0x47d6bc
mov eax, ecx
mov esi, ecx
jmp 0x47d698
mov dword [esp + 0x6c], 0x44
lea edx, [esp + 0x6c]
jmp 0x47e562
mov dword [esp + 4], ecx
or dword [esp + 0x128], 0x80000
lea esi, [esp + 0x6c]
mov ecx, 0x11
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x114], eax
mov dword [esp + 0x180], eax
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0xdc]
lea eax, [esp + 0xb0]
push eax
push edx
push dword [esp + 0x70]
push dword [esp + 0xc]
push dword [esp + 0x138]
push 1
push 0
push 0
push esi
push dword [esp + 0x38]
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x47e69d
mov eax, dword [esp + 0x3c]
movsd xmm1, qword [esp + 0xec]
cmp dword [esp + 0x110], 0
movq xmm0, qword [esp + 0xf4]
movsd xmm2, qword [esp + 0xe4]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0xb0]
movq qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x47e5ee
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 4]
call fcn.0043c640
push dword [esp + 0x60]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x64]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x4c]
call sub.kernel32.dll_CloseHandle
lea ecx, [esp + 0x40]
call fcn.0043b830
test ebx, ebx
je 0x47e627
add ebx, ebx
push 2
push ebx
push dword [esp + 0x40]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47e640
add eax, eax
push 2
push eax
push dword [esp + 0x18]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x47e659
add eax, eax
push 2
push eax
push esi
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 8]
test eax, eax
je 0x47e672
add eax, eax
push 2
push eax
push dword [esp + 0x1c]
call fcn.00401c20
add esp, 0xc
mov ecx, dword [esp + 0x1c]
test edi, edi
setne al
xor cl, 1
test al, cl
mov eax, dword [esp + 0x20]
je 0x47c69f
add edi, edi
push 2
push edi
push eax
call fcn.00401c20
add esp, 0xc
jmp 0x47c69f
call fcn.004c9ea0
movzx ecx, word [esp + 0x50]
mov edx, dword [esp + 0x3c]
cmp dword [esp + 0x110], 0
mov esi, dword [esp + 0x20]
mov word [edx + 1], cx
mov ch, byte [esp + 0x52]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x47e6e1
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 4]
call fcn.0043c640
push dword [esp + 0x60]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x64]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x4c]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xe4], 0
je 0x47e712
push dword [esp + 0xe8]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xec], 0
je 0x47e728
push dword [esp + 0xf0]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xf4], 0
je 0x47e73e
push dword [esp + 0xf8]
call sub.kernel32.dll_CloseHandle
cmp byte [esp + 0x34], 0
je 0x47e762
cmp byte [esp + 0xd4], 0
jne 0x47e78c
mov eax, dword [0x51e0f4]
test eax, 0x7fffffff
je 0x47e78c
call fcn.00471c00
jmp 0x47e77d
cmp byte [esp + 0xd4], 0
jne 0x47e78c
mov eax, dword [0x51e0f4]
test eax, 0x7fffffff
je 0x47e78c
call fcn.00471c00
mov esi, dword [esp + 0x20]
test al, al
jne 0x47e78c
mov byte [0x51e11c], 1
push 0x51e118
call sub.kernel32.dll_ReleaseSRWLockExclusive
test ebx, ebx
je 0x47e7ab
add ebx, ebx
push 2
push ebx
push dword [esp + 0x40]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47e7c4
add eax, eax
push 2
push eax
push dword [esp + 0x18]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x47e7e3
add eax, eax
push 2
push eax
push dword [esp + 0xe4]
call fcn.00401c20
add esp, 0xc
mov eax, dword [esp + 8]
test eax, eax
je 0x47e7fc
add eax, eax
push 2
push eax
push dword [esp + 0x1c]
call fcn.00401c20
add esp, 0xc
cmp byte [esp + 0x1c], 0
mov bl, 1
jne 0x47c69f
test edi, edi
je 0x47e81b
add edi, edi
push 2
push edi
push esi
call fcn.00401c20
add esp, 0xc
test bl, bl
je 0x47c595
jmp 0x47c69f
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x134]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x47d65a
jmp 0x47d669
mov eax, dword [esp + 0x34]
jmp 0x47d9d0
call fcn.004c9ea0
mov byte [esp + 0xe4], 0
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xe4]
mov dword [esp + 0x6c], 0x4e17d4
mov dword [esp + 0x70], 1
mov dword [esp + 0x7c], 0
mov dword [esp + 0xb0], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0xb4], 0x45fc20
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 1
push 0x4e1808
lea eax, [esp + 0x70]
push eax
call fcn.004b4af0
add esp, 8
jmp 0x47ec00
call fcn.004a6fd0
jmp 0x47ec00
push esi
push 1
call fcn.004a7010
add esp, 8
jmp 0x47ec00
call fcn.004a6fd0
jmp 0x47ec00
call fcn.004a6fd0
jmp 0x47ec00
push ebx
push 2
call fcn.004a7010
add esp, 8
jmp 0x47ec00
push ebx
push 1
call fcn.004a7010
add esp, 8
jmp 0x47ec00
push 0x4de3b8
push 0x21
push str.assertion_failed:_self.height___0
call fcn.004b4b80
add esp, 0xc
jmp 0x47ec00
mov dword [esp + 0xc], 4
push dword [esp + 0xc]
push 1
call fcn.004a7010
add esp, 8
jmp 0x47ec00
push 0x4e1f20
push 0x28
push str.internal_error:_entered_unreachable_code
call fcn.004b4b80
add esp, 0xc
jmp 0x47ec00
push 0x4e1f20
push 0x28
push str.internal_error:_entered_unreachable_code
call fcn.004b4b80
add esp, 0xc
jmp 0x47ec00
call fcn.004a6fd0
jmp 0x47ec00
push 0x4e1f10
push eax
push esi
call fcn.004ba670
add esp, 0xc
jmp 0x47ec00
push 0x4e1f10
push eax
push esi
call fcn.004ba670
add esp, 0xc
jmp 0x47ec00
ud2