Function at 0x4d3015
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x664
push ebx
push esi
push edi
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x60], ecx
call fcn.004b9339
call fcn.004b92d9
mov ecx, fcn.00435874
call fcn.004faa0a
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call sub.gdiplus.dll_GdiplusStartup
mov ecx, 0x535d28
call fcn.00466ca2
xor esi, esi
cmp dword [ebp + 0x54], ebx
je 0x4d307f
mov eax, dword [ebp + 0x7c]
mov ecx, dword [eax + esi*4]
call fcn.00466ca2
inc esi
cmp esi, dword [ebp + 0x54]
jne 0x4d306e
mov ecx, 0x535d1c
call fcn.00466ca2
push 0x34
pop ecx
mov esi, 0x54d8f8
mov edi, 0x8b1720
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x88de04
call fcn.0040b22d
mov dword [0x88dc34], ebx
mov dword [0x88dc38], 0x88dc34
mov dword [0x88de8c], ebx
mov dword [0x88de94], ebx
mov dword [0x88de90], ebx
mov dword [0x88de64], ebx
mov dword [0x88de6c], ebx
mov dword [0x88de68], ebx
mov dword [0x88de70], ebx
mov dword [0x88de78], ebx
mov dword [0x88de74], ebx
call fcn.0040d2c9
call fcn.004b859b
mov esi, eax
mov edi, edx
xor ecx, ecx
mov dword [0x88dc80], esi
mov dword [0x88dc84], edi
call fcn.0047a82b
push edi
add eax, 5
push esi
mov dword [0x88dce8], eax
mov dword [0x88c8e0], esi
mov dword [0x88c8e4], edi
call fcn.004b6d07
mov edx, 0x535d08
mov ecx, 0x51497c
call fcn.004b878f
cmp eax, ebx
je 0x4d313e
push 0x510d20
call eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x88f68c], eax
call fcn.00446d75
call fcn.0042622f
xor ebx, ebx
push ebx
push ebx
lea ecx, [ebp + 0x34]
call fcn.004798dc
push dword [ebp + 0x7c]
lea ecx, [ebp + 0x34]
push dword [ebp + 0x54]
call fcn.0047993c
push 0x535cf8
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov edi, eax
push 2
pop eax
cmp edi, ebx
je 0x4d31a2
cmp dword [edi + 8], eax
jl 0x4d3196
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov ebx, dword [edx + ecx*4 + 4]
mov dword [edi + 0x14], eax
jmp 0x4d319b
mov ebx, 0x535ce8
mov ecx, ebx
call fcn.004264ed
lea ecx, [ebp + 0x6c]
call fcn.0049a4d6
mov ecx, eax
call fcn.004a0ff9
mov esi, 0x88d7d8
push esi
call fcn.004c9d65
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
call fcn.00466ca2
call fcn.004fcccb
call fcn.0047d257
push esi
call fcn.00466ca2
add esp, 4
call fcn.0049bf29
call fcn.004cb7af
call fcn.0049a804
push esi
push 0x535cbc
call fcn.00466ca2
push 0x7021
call fcn.00466ca2
add esp, 0xc
push 0x535ca4
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d3295
mov edi, dword [esi + 8]
cmp edi, 2
push 0x1a
mov byte [ebp + 0x7f], 1
pop ebx
jl 0x4d3233
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [ecx + eax*4 + 4]
mov dword [ebp + 0x60], eax
jmp 0x4d3237
and dword [ebp + 0x60], 0
push 0x535c98
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3251
mov byte [ebp + 0x7f], 0
call fcn.0044e36e
cmp edi, 3
jl 0x4d3291
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push dword [ecx + eax*4 + 8]
call sub.msvcrt.dll__wtoi
pop ecx
push 3
mov ebx, eax
pop eax
mov dword [esi + 0x14], eax
mov ecx, 0x535c88
xor esi, esi
call fcn.0046a51b
mov dl, byte [ebp + 0x7f]
mov ecx, dword [ebp + 0x60]
push ebx
call fcn.00435c6e
test al, al
je 0x4d328a
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, edi
jmp 0x4d326a
test edi, edi
je 0x4d32bb
test ebx, ebx
je 0x4d32a8
push ebx
call fcn.00466ca2
add esp, 4
jmp 0x4d32ad
mov ebx, 0x535c78
push ebx
push 0x535c40
call fcn.00466ca2
add esp, 8
call fcn.004bc8ec
mov ecx, 0x517834
call fcn.004bd04e
push fcn.0047d266
lea ecx, [ebp - 0x2c]
call fcn.004a17e9
push fcn.00441a62
lea ecx, [ebp - 0x3c]
call fcn.004a17e9
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, eax
mov dword [0x88ec0c], eax
call fcn.004b7783
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.004812aa
push 0x535c28
lea ecx, [ebp + 0x34]
mov byte [ebp + 0x73], 0
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d334d
xor ecx, ecx
inc ecx
call fcn.004ceb60
push 2
pop ebx
cmp dword [esi + 8], ebx
jl 0x4d3354
push 0x75
pop eax
mov word [0x559fc8], ax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, dword [ecx + eax*4 + 4]
push 0xd
mov ecx, 0x559fd8
call fcn.00428b90
mov dword [esi + 0x14], ebx
jmp 0x4d3354
push 2
mov byte [ebp + 0x73], 1
pop ebx
push 0x534f64
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3370
mov ecx, ebx
call fcn.004ceb60
mov byte [ebp + 0x73], 0
cmp byte [ebp + 0x73], 0
je 0x4d337d
xor ecx, ecx
call fcn.004ceb60
push 0x535c14
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3395
mov byte [0x88f689], 1
push dword [ebp + 0x60]
mov ecx, 0x56bf8c
call fcn.00475b09
push 0x535c04
lea ecx, [ebp + 0x34]
mov dword [0x56bf90], 0x512da8
mov byte [ebp + 0x58], 0
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d3403
call fcn.00466ca2
and dword [ebp + 0x60], 0
mov dl, 1
lea ecx, [ebp + 0x60]
mov byte [ebp + 0x58], 1
mov byte [0x56aa5c], 1
call fcn.004cc247
mov dl, 1
mov ecx, eax
call fcn.00479b79
cmp dword [esi + 8], ebx
jl 0x4d3403
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [ebp + 0x60]
mov dword [esi + 0x14], ebx
mov ecx, dword [ecx + eax*4 + 4]
call fcn.004fac72
mov ecx, 0x535bf8
call fcn.0049a515
push eax
lea ecx, [ebp + 0x50]
call fcn.004a0fd9
lea ecx, [ebp + 0x50]
call fcn.004a0ff9
mov ecx, eax
call fcn.004cb81a
cmp dword [0x890344], 0
mov byte [ebp + 0x70], 0
mov byte [ebp + 0x73], 0
mov byte [ebp + 0x66], 0
mov edi, 0x6477021
jne 0x4d3445
mov dword [0x890344], edi
call fcn.00439728
call fcn.004484ad
and byte [ebp + 0x31], 0xfe
and dword [ebp + 0x28], 0
and dword [ebp + 0x2c], 0
mov esi, 0x50fa3c
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x24], esi
mov byte [ebp + 0x30], 0
call fcn.0040baef
mov ecx, 0x535070
call fcn.0049a53c
push eax
lea ecx, [ebp + 0x60]
call fcn.004a0fd9
lea ecx, [ebp + 0x60]
call fcn.004a0ff9
lea edx, [ebp + 0x24]
mov ecx, eax
call fcn.0049a633
test al, al
je 0x4d34a6
cmp byte [ebp + 0x30], 4
jne 0x4d34a6
lea ecx, [ebp + 0x24]
call fcn.004a4e55
lea ecx, [ebp + 0x60]
call fcn.004a0c7d
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x24], esi
call fcn.0040ba32
push 0x535bf0
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
setne al
push 0x535bdc
lea ecx, [ebp + 0x34]
mov byte [0x56b6c1], al
mov byte [ebp + 0x67], 0
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d34eb
mov byte [ebp + 0x67], 1
inc dword [0x890314]
cmp dword [0x8901f0], edi
je 0x4d352e
push 0xa
pop ecx
push 0xa
xor eax, eax
mov edi, 0x890294
rep stosd dword es:[edi], eax
pop ecx
push eax
push 0x3e8
push ebx
push eax
push eax
push 0x1a
mov edi, 0x89026c
push 0xffff
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push eax
call fcn.00466ca2
add esp, 4
cmp dword [0x88f7fc], ebx
je 0x4d353d
mov byte [0x88f822], 0
test esi, esi
je 0x4d354f
mov dword [0x88f81c], 0x7021
mov byte [ebp + 0x70], 1
push 0x535bc0
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3588
mov ecx, dword [eax + 8]
cmp ecx, ebx
jl 0x4d3572
mov edx, dword [eax + 4]
mov esi, dword [eax]
mov edx, dword [esi + edx*4 + 4]
jmp 0x4d3574
xor edx, edx
cmp ecx, ebx
mov dword [ebp - 0xc], edx
jle 0x4d357d
mov ecx, ebx
mov dword [eax + 0x14], ecx
mov byte [ebp + 0x70], 1
mov byte [ebp + 0x73], 1
mov cl, byte [ebp + 0x73]
call fcn.004a28ca
push 0x208
lea eax, [ebp - 0x2cc]
push eax
push 0x51e874
mov edx, 0x535b38
mov ecx, 0x80000001
call fcn.0044f8a9
test al, al
je 0x4d383c
xor bl, bl
call fcn.00466ca2
push 8
pop ecx
mov esi, 0x535b14
lea edi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc4]
call fcn.0049e64a
push eax
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4d3601
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
inc bl
call fcn.00466ca2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4d379c
push 1
push 0x1c
lea eax, [ebp - 0x4d4]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4d378e
mov edx, 0x535b00
lea ecx, [ebp - 0x4d4]
call fcn.004b7a3f
push 0x104
mov edx, eax
lea ecx, [ebp - 0x4d4]
mov dword [ebp + 0x68], eax
call fcn.00428b90
lea ecx, [ebp + 0x68]
call fcn.004a0cb3
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp + 0x6c]
push 0x535acc
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
call fcn.00466ca2
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
xor edi, edi
push edi
lea edx, [ebp - 0x4d4]
lea ecx, [ebp + 0x28]
mov byte [ebp + 0x72], 1
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x2c], edi
call fcn.00482781
xor ecx, ecx
call fcn.0047a82b
xor esi, esi
mov ebx, eax
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0x30], edi
jbe 0x4d3767
mov eax, dword [ebp + 0x28]
lea eax, [eax + esi*4]
mov edx, dword [eax]
lea ecx, [ebp - 0x4d4]
call fcn.004b7a3f
mov ecx, eax
mov dword [ebp + 0x68], eax
call fcn.0048265e
push ebx
mov edi, eax
push edi
push dword [ebp + 0x68]
lea eax, [ebp + 0x6c]
push 0x535a88
push eax
mov dword [ebp + 0x60], edx
call fcn.004a1618
add esp, 0x14
mov ecx, eax
call fcn.004a0ff9
call fcn.00466ca2
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
mov ecx, dword [ebp + 0xc]
mov eax, ebx
sub eax, edi
sbb ecx, dword [ebp + 0x60]
mov dword [ebp - 0x5c], ecx
js 0x4d372f
jg 0x4d371d
cmp eax, 0x12c
jb 0x4d372f
mov ecx, dword [ebp + 0x68]
mov dl, 1
call fcn.00479b79
inc esi
cmp esi, dword [ebp + 0x30]
jb 0x4d36b9
jmp 0x4d3765
push dword [ebp + 0x68]
lea eax, [ebp + 0x6c]
push 0x535a20
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
call fcn.00466ca2
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
mov ecx, dword [ebp + 0x68]
mov dl, 1
call fcn.00479b79
mov byte [ebp + 0x72], 0
xor edi, edi
xor esi, esi
cmp dword [ebp + 0x30], edi
jbe 0x4d3781
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + esi*4]
mov dl, 1
call fcn.00479b79
inc esi
cmp esi, dword [ebp + 0x30]
jb 0x4d376e
lea ecx, [ebp + 0x28]
mov dword [ebp + 0x30], edi
call fcn.004a0bd2
jmp 0x4d3792
mov byte [ebp + 0x72], 1
cmp byte [ebp + 0x72], 0
je 0x4d383c
lea ecx, [ebp - 0x2cc]
call fcn.0049e64a
lea edx, [ebp - 0x2cc]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4d37ad
lea eax, [ebp - 0x2cc]
push 0x535a14
push eax
call sub.msvcrt.dll_strstr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4d37e9
lea eax, [ebp - 0x2cc]
push 0x535a08
push eax
call sub.msvcrt.dll_strstr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4d383c
lea edi, [ebp - 0x2cc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d37f0
push 4
lea eax, [ebp - 0x2cc]
mov esi, 0x535a04
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebx], 0
cmp byte [ebp - 0x2cc], 0x22
lea ecx, [ebp - 0x2cb]
je 0x4d3830
lea ecx, [ebp - 0x2cc]
call fcn.0049e604
mov ecx, eax
call fcn.004697fe
xor edx, edx
xor cl, cl
call fcn.004ce989
lea ecx, [ebp - 0x3c]
call fcn.00442f51
call fcn.0044127f
call fcn.0048ec85
call fcn.004a7060
call fcn.004cd643
xor edi, edi
inc edi
mov dword [0x899aa4], edi
call fcn.0046a59c
call fcn.0047dd45
lea ecx, [ebp - 0x2c]
call fcn.00480c4e
push 0x5359f0
lea ecx, [ebp + 0x34]
mov byte [ebp + 0x72], 0
mov dword [ebp + 0x60], 3
call fcn.004798b1
lea ecx, [ebp + 0x34]
test eax, eax
je 0x4d38d7
push 0x5359ec
mov byte [ebp + 0x7f], 0
xor bl, bl
call fcn.004798b1
test eax, eax
je 0x4d38b3
mov byte [ebp + 0x7f], 1
push 0x5359d4
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d38c6
mov bl, 1
mov cl, byte [ebp + 0x7f]
mov dl, bl
call fcn.0046d781
push 0
jmp 0x4d328b
push 0x5359c4
call fcn.004798b1
test eax, eax
je 0x4d38ec
mov byte [0x894340], 1
push 0x5359b0
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3919
cmp dword [eax + 8], edi
jle 0x4d3919
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ecx, dword [edx + ecx*4 + 4]
push 2
pop ebx
mov dword [0x88f694], ecx
mov dword [eax + 0x14], ebx
jmp 0x4d391c
push 2
pop ebx
push 0x534f4c
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3934
mov byte [0x56bf95], 1
lea ecx, [ebp + 0x10]
call fcn.004a0e93
lea ecx, [ebp + 4]
call fcn.004a0e93
xor eax, eax
push 0x53598c
lea ecx, [ebp + 0x34]
mov dword [ebp - 8], eax
mov dword [ebp], eax
mov dword [ebp - 4], eax
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d397b
cmp dword [esi + 8], edi
jle 0x4d397b
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push dword [ecx + eax*4 + 4]
lea ecx, [ebp + 0x10]
call fcn.004a101e
mov dword [esi + 0x14], ebx
push 0x535960
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d39a7
cmp dword [esi + 8], edi
jle 0x4d39a7
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push dword [ecx + eax*4 + 4]
lea ecx, [ebp + 4]
call fcn.004a101e
mov dword [esi + 0x14], ebx
xor edi, edi
push edi
lea eax, [ebp + 4]
push eax
lea edx, [ebp + 0x10]
lea ecx, [ebp - 8]
call fcn.004cf5ea
cmp dword [ebp], edi
jbe 0x4d39d4
xor esi, esi
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
call fcn.0046c7aa
inc edi
add esi, 0xc
cmp edi, dword [ebp]
jb 0x4d39c0
push 0x535940
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d3bf8
mov ecx, 0x535904
call fcn.00466ca2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esi + 0x14], 5
mov ebx, dword [ecx + eax*4 + 4]
push dword [ecx + eax*4 + 8]
mov dword [ebp + 0xc], ebx
call sub.msvcrt.dll__wtoi
mov edi, eax
mov eax, dword [esi + 4]
pop ecx
mov ecx, dword [esi]
mov eax, dword [ecx + eax*4 + 0xc]
mov dword [0x56bb08], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4 + 0x10]
call fcn.0049ff51
mov esi, 0x56bb40
mov ecx, esi
mov dword [0x56bafc], eax
call fcn.0040baef
test ebx, ebx
je 0x4d3bf1
cmp word [ebx], 0
je 0x4d3bf1
mov edx, esi
mov ecx, ebx
call fcn.0049a633
test al, al
je 0x4d3bf1
mov dword [0x556c94], esi
mov ebx, 0x46757d
test edi, 0xfffffeff
je 0x4d3b30
lea ecx, [ebp + 0x68]
call fcn.004a0e93
mov edx, 0x5162f4
xor ecx, ecx
call fcn.0048245f
push eax
lea ecx, [ebp + 0x68]
call fcn.004a0c86
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
je 0x4d3ad6
lea ecx, [ebp + 0x68]
call fcn.004a0ff9
mov ecx, dword [0x556c94]
push eax
push 0
push 0
push 0x51fda0
call fcn.0040ba1a
mov ecx, eax
call fcn.0040b2aa
push eax
mov ecx, esi
call fcn.00466c7a
mov esi, eax
jmp 0x4d3ad8
xor esi, esi
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.004a0ff9
mov ecx, eax
call fcn.0042876e
push 0x55a690
lea ecx, [ebp + 0x6c]
mov dword [0x55a698], eax
mov dword [0x55a694], ebx
call fcn.00401966
lea eax, [ebp + 0x6c]
push eax
push 1
push esi
lea ecx, [esi + 0xc]
call fcn.004a0e99
mov edx, fcn.0046e144
mov ecx, eax
call fcn.0046c139
mov ecx, dword [ebp + 0x6c]
test ecx, ecx
je 0x4d3b28
call fcn.00401728
lea ecx, [ebp + 0x68]
call fcn.004a0c7d
test edi, 0x100
je 0x4d3be8
lea ecx, [ebp + 0x68]
call fcn.004a0e93
mov edx, 0x5162f4
xor ecx, ecx
call fcn.0048245f
push eax
lea ecx, [ebp + 0x68]
call fcn.004a0c86
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
je 0x4d3b8e
lea ecx, [ebp + 0x68]
call fcn.004a0ff9
mov ecx, dword [0x556c94]
push eax
push 0
push 0x5200b8
call fcn.0040b398
push eax
mov ecx, esi
call fcn.00466c7a
mov esi, eax
jmp 0x4d3b90
xor esi, esi
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.004a0ff9
mov ecx, eax
call fcn.0042876e
push 0x55a6bc
lea ecx, [ebp + 0x6c]
mov dword [0x55a6c4], eax
mov dword [0x55a6c0], ebx
call fcn.00401966
lea eax, [ebp + 0x6c]
push eax
push 1
push esi
lea ecx, [esi + 0xc]
call fcn.004a0e99
mov edx, 0x46a9b7
mov ecx, eax
call fcn.0046c139
mov ecx, dword [ebp + 0x6c]
test ecx, ecx
je 0x4d3be0
call fcn.00401728
lea ecx, [ebp + 0x68]
call fcn.004a0c7d
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 2
mov byte [ebp + 0x72], 1
pop ebx
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x60
pop ecx
cmp eax, ecx
mov dword [0x88f6a0], eax
jg 0x4d3c1d
mov dword [0x88f6a0], ecx
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.004cb539
call fcn.0044e30a
push 0x5358e4
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d3cea
cmp dword [esi + 8], ebx
jl 0x4d3c5f
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push dword [ecx + eax*4 + 4]
call sub.msvcrt.dll__wtoi
pop ecx
mov ebx, eax
jmp 0x4d3c64
mov ebx, 0x100
mov eax, dword [esi + 8]
cmp eax, 3
jl 0x4d3c77
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [edx + ecx*4 + 8]
jmp 0x4d3c79
xor edi, edi
cmp eax, 4
jl 0x4d3c9f
cmp byte [0x88f688], 0
je 0x4d3c9f
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push dword [ecx + eax*4 + 0xc]
call sub.msvcrt.dll__wtol
pop ecx
mov edx, eax
mov cl, 1
call fcn.004ce989
mov eax, dword [esi + 8]
cmp eax, 4
jle 0x4d3caa
push 4
pop eax
mov dword [esi + 0x14], eax
mov eax, edi
test edi, edi
jne 0x4d3cb8
mov eax, 0x517834
push eax
push ebx
push 0x535868
call fcn.00466ca2
mov edx, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
push edi
push ebx
lea eax, [ebp + 0x71]
push eax
push dword [ebp + 0x58]
mov byte [ebp + 0x72], 1
call fcn.00470c79
mov dword [ebp + 0x60], eax
call fcn.0044e36e
push 2
pop ebx
push 0x535850
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3d05
mov dword [0x55a034], 0x6477020
push 0x535834
lea ecx, [ebp + 0x34]
call fcn.004798b1
test eax, eax
je 0x4d3d1a
mov byte [ebp + 0x66], 1
cmp byte [ebp + 0x72], 0
je 0x4d3d2d
call fcn.00468cbf
push dword [ebp + 0x60]
jmp 0x4d328b
push 0x535820
lea ecx, [ebp + 0x34]
call fcn.004798b1
mov esi, eax
test esi, esi
je 0x4d3d89
cmp dword [esi + 8], ebx
jl 0x4d3d89
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4 + 4]
call fcn.0049e64a
mov edx, eax
mov ecx, 0x890410
call fcn.0049fe6d
push 3
pop edi
cmp dword [esi + 8], edi
jl 0x4d3d86
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4 + 8]
call fcn.0049e64a
mov edx, eax
mov ecx, 0x890414
call fcn.0049fe6d
mov dword [esi + 0x14], edi
jmp 0x4d3d89
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4d3dc8
mov edi, dword [eax + 0x14]
lea esi, [eax + 8]
mov ecx, dword [esi]
cmp edi, ecx
jge 0x4d3dc8
lea ebx, [eax + 4]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add eax, edi
mov eax, dword [ecx + eax*4]
push 4
mov dword [ebp + 0x6c], eax
push 1
lea eax, [ebp + 0x6c]
push eax
mov ecx, 0x890514
call fcn.004a117a
inc edi
cmp edi, dword [esi]
jl 0x4d3da2
lea ecx, [ebp - 0x48]
call fcn.004d2ee2
mov cl, byte [ebp + 0x58]
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp + 0x71]
call fcn.004d285c
test al, al
je 0x4d38d0
cmp byte [ebp + 0x73], 0
jne 0x4d3df2
call fcn.0046c537
cmp dword [0x88f7fc], 2
je 0x4d3e08
call fcn.004cf792
test al, al
je 0x4d38d0
call fcn.004c9e72
or byte [ebp + 0x70], al
call fcn.0049b96a
cmp byte [ebp + 0x70], 0
jne 0x4d3e3a
mov edx, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x54]
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp + 0x71]
push eax
push dword [ebp + 0x58]
call fcn.00470c79
mov edi, eax
call fcn.004cb9e9
jmp 0x4d3e77
cmp byte [ebp + 0x73], 0
je 0x4d3e72
push dword [ebp - 0xc]
mov edx, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x54]
push 0x10000
lea eax, [ebp + 0x71]
push eax
push dword [ebp + 0x58]
call fcn.00470c79
mov edi, eax
call fcn.0046a110
test al, al
je 0x4d3e6b
push edi
jmp 0x4d328b
call fcn.004cb9e9
jmp 0x4d3e75
mov edi, dword [ebp + 0x60]
xor ebx, ebx
mov eax, dword [0x890474]
cmp word [eax], bx
je 0x4d3fb1
push 0x51e114
push eax
call sub.msvcrt.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x4d3f3c
push dword [0x890474]
push 0x535800
call fcn.00466ca2
add esp, 8
push dword [0x890474]
lea ecx, [ebp + 0x60]
call fcn.004a0fd9
lea edx, [ebp + 0x60]
lea ecx, [ebp + 0x6c]
call fcn.004a164d
push ebx
lea eax, [ebp + 0x7f]
push eax
push ebx
lea ecx, [ebp + 0x6c]
mov byte [ebp + 0x7f], 0
call fcn.004a0e99
push eax
lea ecx, [ebp - 0xa4]
call fcn.00483188
cmp byte [ebp + 0x7f], 0
je 0x4d3f24
mov esi, 0x890410
mov ecx, esi
call fcn.004a0cb3
mov edx, dword [ebp - 0x98]
mov ecx, esi
call fcn.0049fe6d
cmp dword [ebp - 0x84], ebx
je 0x4d3f24
mov esi, 0x890414
mov ecx, esi
call fcn.004a0cb3
mov edx, dword [ebp - 0x84]
mov ecx, esi
call fcn.0049fe6d
lea ecx, [ebp - 0xa4]
call fcn.00483177
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
lea ecx, [ebp + 0x60]
jmp 0x4d3f9b
push ebx
lea ecx, [ebp + 0x6c]
call fcn.004a0fd9
mov ecx, dword [0x890474]
call fcn.0049e627
push eax
lea ecx, [ebp + 0x7c]
call fcn.004a0fd9
cmp byte [0x890478], 0
lea ecx, [ebp + 0x28]
setne al
movzx eax, al
push eax
push 1
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00466c4a
mov ecx, eax
call fcn.0046c7aa
lea ecx, [ebp + 0x2c]
call fcn.004a0c7d
lea ecx, [ebp + 0x28]
call fcn.004a0c7d
lea ecx, [ebp + 0x7c]
call fcn.004a0c7d
lea ecx, [ebp + 0x6c]
call fcn.004a0c7d
mov ecx, 0x890474
call fcn.004a0cb3
mov byte [0x890478], 0
mov eax, edi
sub eax, ebx
je 0x4d4426
dec eax
je 0x4d4442
dec eax
je 0x4d442c
dec eax
dec eax
je 0x4d3e65
sub eax, 3
je 0x4d3e65
mov ecx, 0x535bf8
call fcn.0049a515
push eax
lea ecx, [ebp + 0x50]
call fcn.004a101e
lea ecx, [ebp + 0x50]
call fcn.004a0ff9
mov ecx, eax
call fcn.004cb81a
call fcn.004cb91b
mov cl, byte [0x88f7d0]
call fcn.004cb389
mov ecx, 0x88f6b8
push ecx
call fcn.00466ca2
add esp, 4
call fcn.0049e64a
push eax
call fcn.00466ca2
mov dword [esp], 0x7021
push 3
push 2
push 3
call fcn.00466ca2
mov dl, byte [ebp + 0x67]
mov cl, byte [ebp + 0x58]
add esp, 0x10
call fcn.004cb7e2
lea ecx, [ebp + 0x34]
call fcn.004798ff
call fcn.0046d04b
push 0xe
pop edi
test al, al
je 0x4d405f
mov dword [0x88f9dc], edi
call fcn.004c9f19
mov byte [0x88f68a], al
call fcn.00499ac6
cmp byte [0x88f93f], 0
je 0x4d4092
xor ecx, ecx
call fcn.0044bd7b
test eax, eax
je 0x4d4092
call fcn.004b859b
mov dword [0x88f698], eax
mov dword [0x88f69c], edx
call fcn.0047cfd9
push 0x3c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x4d40ac
mov ecx, eax
call fcn.0040cbb2
jmp 0x4d40ae
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x88dcf0], eax
add eax, 4
push eax
call esi
mov ecx, dword [0x88dcf0]
call fcn.0047e348
push 0x3c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x4d40df
mov ecx, eax
call fcn.0040cbb2
jmp 0x4d40e1
xor eax, eax
mov dword [0x88dcf4], eax
add eax, 4
push eax
call esi
mov ecx, dword [0x88dcf4]
call fcn.0047e348
push 0x3c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x4d410c
mov ecx, eax
call fcn.0040cbb2
jmp 0x4d410e
xor eax, eax
mov dword [0x88dcec], eax
add eax, 4
push eax
call esi
mov ecx, dword [0x88dcec]
call fcn.0047e348
call fcn.0047cff8
cmp byte [0x88f99e], 0
je 0x4d4138
mov dword [0x88f870], ebx
call fcn.0049b55c
mov byte [0x88d9e0], al
call fcn.0049afe5
mov eax, dword [0x8901f0]
mov esi, 0x6477021
cmp eax, ebx
je 0x4d4163
cmp eax, esi
je 0x4d4176
call fcn.0049a77e
mov eax, dword [0x8901f0]
cmp eax, esi
je 0x4d4176
cmp byte [0x88f98a], 0
je 0x4d4176
mov dword [0x88f9dc], edi
cmp eax, ebx
jne 0x4d4189
cmp dword [0x88d718], ebx
je 0x4d418d
mov byte [0x88f98a], 1
cmp eax, esi
je 0x4d4192
call fcn.004cba28
and dword [0x568090], 0xbfffffff
mov dword [0x8901f0], esi
call fcn.004a64bf
mov cl, 1
call fcn.004cb8c2
lea eax, [ebp + 0x7c]
push eax
mov ecx, 0x88ddec
call fcn.00409044
mov ecx, dword [ebp + 0x7c]
call fcn.00441612
call fcn.004707b4
call fcn.004941ab
xor edi, edi
inc edi
cmp dword [0x88f7fc], edi
je 0x4d41e3
xor dl, dl
lea ecx, [ebp + 0x7c]
call fcn.004cc247
cmp dword [0x88f85c], ebx
jne 0x4d41f0
call fcn.00469f91
call fcn.004afcd4
mov esi, eax
cmp esi, edi
je 0x4d4205
cmp esi, 5
je 0x4d4205
cmp esi, 4
jne 0x4d4219
push 0x52e7f8
call fcn.004263e6
pop ecx
xor dl, dl
xor cl, cl
call fcn.004afb79
cmp esi, ebx
je 0x4d4221
cmp esi, edi
jne 0x4d427b
call fcn.00406a29
test al, al
jne 0x4d4241
cmp byte [0x890479], al
je 0x4d4241
mov edx, 0x52b950
mov ecx, 0x5181bc
call fcn.004463a2
mov ecx, 0x5163d0
call fcn.004a2823
test al, al
jne 0x4d425e
mov edx, 0x52e234
mov ecx, 0x5181b0
call fcn.004463a2
mov ecx, 0x5130c8
call fcn.004a2823
test al, al
jne 0x4d427b
mov edx, 0x52e210
mov ecx, 0x5181a4
call fcn.004463a2
lea ecx, [ebp - 0x10]
call fcn.004e7964
mov eax, dword [0x89016c]
cmp eax, ebx
je 0x4d429a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d428f
sub eax, edx
jne 0x4d42a2
mov eax, dword [ebp - 0x10]
mov dword [0x89016c], eax
call fcn.004bd1b7
test al, al
jne 0x4d42d6
lea eax, [ebp + 0x14]
push 0x535790
push eax
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x18], 0x30
call fcn.00477c73
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x89444c], eax
mov dword [0], ebx
lea ecx, [ebp - 0x5f0]
call fcn.004cdd43
lea ecx, [ebp - 0x5f0]
call fcn.004cf4c4
push ebx
xor edx, edx
mov ecx, 0x4a6491
call fcn.004b78f5
call fcn.0046d04b
test al, al
je 0x4d4307
call fcn.0046d069
push 0xa18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x4d432a
push dword [0x88f7f8]
mov ecx, eax
call fcn.00447212
mov dword [0x88f6b0], eax
jmp 0x4d4330
mov dword [0x88f6b0], ebx
mov eax, dword [0x89039c]
cmp eax, ebx
je 0x4d435b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4d433c
sub eax, edx
sar eax, 1
je 0x4d435b
mov edx, 0x89039c
mov ecx, 0x890178
call fcn.0049dfe5
cmp byte [ebp + 0x66], 0
je 0x4d4375
cmp dword [0x88f7fc], ebx
je 0x4d4375
push dword [ebp - 0x5ec]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0047298b
test al, al
je 0x4d4389
push 0x535768
call fcn.004263e6
pop ecx
call fcn.0047cfd9
lea ecx, [ebp - 0x58]
call fcn.004a5055
test al, al
je 0x4d43b3
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x535738
movsd dword es:[edi], dword [esi]
call fcn.004263e6
add esp, 0x14
call fcn.0048e4cd
call fcn.0047cff8
call fcn.00466ca2
xor edx, edx
mov ecx, 0x119
call fcn.004c9f62
cmp byte [0x88f689], 0
jne 0x4d4402
cmp byte [0x56bf95], 0
jne 0x4d4402
mov al, byte [0x88f918]
mov cl, al
and cl, 1
shr al, 2
movzx ecx, cl
and al, 1
movzx eax, al
push ecx
mov ecx, dword [0x88f7f4]
push eax
call fcn.004cf26c
mov ecx, 0x56bf8c
call fcn.00475b86
call fcn.00466ca2
lea ecx, [ebp - 0x2c]
call fcn.0047d266
lea ecx, [ebp - 0x3c]
call fcn.00441a62
call fcn.00466ca2
push ebx
jmp 0x4d328b
lea ecx, [ebp + 0x71]
mov byte [0x88f689], 1
call fcn.004cb9d9
push 2
jmp 0x4d328b
lea ecx, [ebp + 0x71]
call fcn.004cb9d9
push 1
jmp 0x4d328b