Function at 0x412150
Capabilities:
Check mutex on windows
Read file via mapping
Set current directory

Disassembly:
mov rax, rsp
sub rsp, 0x6e8
mov qword [rsp + 0x3b8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00469048]
mov qword [rsp + 0x6a0], rax
mov qword [rsp + 0x140], rdx
mov dword [rsp + 0x5c], ecx
lea rdx, [0x00451d1c]
xor ecx, ecx
call fcn.0042bbd0
mov edx, 1
lea rcx, [rsp + 0x3c0]
call fcn.0041cd10
nop
lea rcx, [rsp + 0x250]
call fcn.00408a40
nop
lea r15, [section..SHMMESS]
mov qword [rsp + 0x148], r15
xor r12d, r12d
mov r14, r12
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x3c0]
call fcn.0040c280
nop
lea r8, [0x00451670]
lea r13, [0x00451630]
mov edi, dword [rsp + 0x98]
test edi, edi
je 0x41233c
mov ecx, r12d
mov rax, r12
test edi, edi
jle 0x412244
mov rdx, qword [rsp + 0x90]
cmp byte [rdx + rax], 0x5c
jne 0x41223b
mov byte [rdx + rax], 0x2e
mov edi, dword [rsp + 0x98]
inc ecx
inc rax
cmp ecx, edi
jl 0x412222
lea rsi, str..j2e.mapping
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2b0], r8
mov ebx, r12d
nop
inc ebx
movsxd rax, ebx
cmp byte [rax + rsi], 0
jne 0x412260
mov dword [rsp + 0x2c0], ebx
lea edx, [rbx + rdi]
lea rcx, [rsp + 0x88]
mov rax, qword [rsp + 0x88]
call qword [rax + 8]
cmp edi, edi
jge 0x4122b0
movsxd rax, edi
mov r8, qword [rsp + 0x90]
lea rdx, [rax + r8]
movsxd rcx, ebx
add rcx, rax
add rcx, r8
mov eax, edi
sub eax, edi
movsxd r8, eax
call fcn.004286b0
movsxd r8, ebx
movsxd rcx, edi
add rcx, qword [rsp + 0x90]
mov rdx, rsi
call fcn.004286b0
nop
mov qword [rsp + 0x2b0], r13
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x88]
mov rax, qword [rsp + 0x88]
call qword [rax + 8]
mov r11, qword [rsp + 0x90]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x1000
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rsp + 0x148], rax
mov rdx, r15
lea rcx, [rsp + 0x470]
call fcn.004258d0
nop
lea rax, [rsp + 0x3c0]
mov qword [0x0046ac48], rax
lea rax, [rsp + 0x250]
mov qword [0x0046ac50], rax
lea rax, [rsp + 0x470]
mov qword [0x0046ac58], rax
xor eax, eax
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], eax
mov dword [rsp + 0xa8], 8
lea rcx, [rsp + 0xa8]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x3c0]
call fcn.0041f000
nop
lea rbp, [0x00451660]
cmp dword [rsp + 0x1a0], 0
je 0x412430
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x3c0]
call fcn.00404560
nop
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.0040e5c0
nop
mov qword [rsp + 0x1d0], rbp
mov rcx, qword [rsp + 0x1d8]
mov qword [rsp + 0x1d8], r12
mov dword [rsp + 0x1e0], r12d
mov dword [rsp + 0x1e8], r12d
test rcx, rcx
je 0x412423
call fcn.004289f0
mov qword [rsp + 0x1d0], r13
jmp 0x4124ca
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov edx, 0x64
call qword [sym.imp.USER32.dll_LoadBitmapA]
mov rbx, rax
test rax, rax
je 0x4124ca
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x3c0]
call fcn.0040cbd0
nop
mov edx, dword [rsp + 0x160]
lea rcx, [rsp + 0x150]
mov r8, qword [rsp + 0x150]
call qword [r8 + 8]
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.00423b30
nop
mov qword [rsp + 0x150], rbp
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x158], r12
mov dword [rsp + 0x160], r12d
mov dword [rsp + 0x168], r12d
test rcx, rcx
je 0x4124c2
call fcn.004289f0
mov qword [rsp + 0x150], r13
lea rdx, [rsp + 0x170]
mov rcx, qword [0x0046ac48]
call fcn.0040da30
nop
mov edx, dword [rsp + 0x180]
test edx, edx
jle 0x4125a7
lea rcx, [rsp + 0x170]
mov rax, qword [rsp + 0x170]
call qword [rax + 8]
mov rdi, qword [rsp + 0x178]
lea rdx, [rsp + 0x210]
mov rcx, qword [0x0046ac48]
call fcn.0040dc50
mov rbx, rax
mov r8, qword [rax]
mov edx, dword [rax + 0x10]
mov rcx, rax
call qword [r8 + 8]
mov r9d, 0x104
lea r8, [rsp + 0x590]
mov rdx, rdi
mov rcx, qword [rbx + 8]
call fcn.0040afb0
mov ebx, eax
mov qword [rsp + 0x210], rbp
mov rcx, qword [rsp + 0x218]
mov qword [rsp + 0x218], r12
mov dword [rsp + 0x220], r12d
mov dword [rsp + 0x228], r12d
test rcx, rcx
je 0x41257b
call fcn.004289f0
mov qword [rsp + 0x210], r13
lea eax, [rbx - 1]
cmp eax, 0x102
ja 0x41259b
lea rcx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, qword [0x0046ac48]
call fcn.00414850
lea rdx, [rsp + 0xb0]
mov rcx, qword [0x0046ac48]
call fcn.0040d810
nop
mov edx, dword [rsp + 0xc0]
test edx, edx
je 0x4125ee
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0xb0]
call qword [rax + 8]
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x0046acd0]
call fcn.00425330
lea rdx, [rsp + 0x120]
mov rcx, qword [0x0046ac48]
call fcn.0040d5f0
nop
mov edx, dword [rsp + 0x130]
test edx, edx
je 0x412635
lea rcx, [rsp + 0x120]
mov rax, qword [rsp + 0x120]
call qword [rax + 8]
mov rdx, qword [rsp + 0x128]
lea rcx, [0x0046acd0]
call fcn.00425260
mov edx, dword [rsp + 0xc0]
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0xb0]
call qword [rax + 8]
mov r11, qword [rsp + 0xb8]
mov qword [rsp + 0x2d0], r11
mov ecx, r12d
mov dword [rsp + 0x2d8], r12d
test r11, r11
je 0x412687
cmp byte [r11], cl
je 0x412687
inc ecx
movsxd rax, ecx
cmp byte [rax + r11], 0
jne 0x412674
mov dword [rsp + 0x2d8], ecx
mov eax, ecx
mov edi, dword [rsp + 0x130]
cmp edi, ecx
cmovl eax, edi
mov r8d, r12d
mov r9, r12
movsxd rbx, eax
mov rsi, qword [rsp + 0x128]
test eax, eax
jle 0x4126cf
mov rdx, rsi
mov r10, r11
sub r10, rsi
movzx eax, byte [r10 + rdx]
cmp byte [rdx], al
jne 0x4126ca
inc r8d
inc r9
inc rdx
cmp r9, rbx
jl 0x4126b3
test r8d, r8d
js 0x4126de
cmp r8d, edi
jge 0x4126de
movsxd rax, r8d
movzx r9d, byte [rax + rsi]
jmp 0x4126e1
xor r9b, r9b
test r8d, r8d
js 0x4126f5
cmp r8d, ecx
jge 0x4126f5
movsxd rax, r8d
movzx edx, byte [rax + r11]
jmp 0x4126f7
xor dl, dl
movsx ecx, r9b
movsx eax, dl
sub ecx, eax
mov qword [rsp + 0x2c8], r13
mov eax, r12d
sete al
mov dword [0x0046ac40], eax
mov dword [rsp + 0x60], r12d
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x3c0]
call fcn.0040d440
mov rbx, rax
mov r8, qword [rax]
mov edx, dword [rax + 0x10]
mov rcx, rax
call qword [r8 + 8]
lea r8, [rsp + 0x60]
lea rdx, [0x00452824]
mov rcx, qword [rbx + 8]
call fcn.00428580
nop
mov qword [rsp + 0x1f0], rbp
mov rcx, qword [rsp + 0x1f8]
mov qword [rsp + 0x1f8], r12
mov dword [rsp + 0x200], r12d
mov dword [rsp + 0x208], r12d
test rcx, rcx
je 0x412786
call fcn.004289f0
mov qword [rsp + 0x1f0], r13
lea rcx, [rsp + 0x528]
lea r13, [0x00400000]
mov rax, qword [r13 + 0x52808]
mov qword [rcx], rax
mov rax, qword [r13 + 0x52810]
mov qword [rcx + 8], rax
mov rax, qword [r13 + 0x52818]
mov qword [rcx + 0x10], rax
movzx eax, byte [r13 + 0x52820]
mov byte [rcx + 0x18], al
lea rcx, [rsp + 0x528]
lea rbx, [0x0046ad20]
mov rdx, rbx
mov edi, 0x19
mov r8, rdi
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x4127e2
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00429f40
test rax, rax
je 0x412842
movzx eax, byte [rbx]
test al, al
js 0x412815
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x412815
mov al, 0x2e
jmp 0x412818
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x004520f0]
call fcn.0042a690
inc rbx
dec rdi
jne 0x412803
lea rcx, [0x004520ec]
call fcn.0042a690
lea rbx, [0x0046ad20]
cmp byte [0x0046ad20], 0
je 0x412902
mov ecx, dword [rsp + 0x60]
call fcn.0041f520
test eax, eax
jne 0x412902
lea edx, [rax + 9]
lea rcx, [rsp + 0x2e0]
call fcn.0040f0a0
nop
mov edx, 0xa
lea rcx, [rsp + 0x340]
call fcn.0040f0a0
nop
mov edx, dword [rsp + 0x350]
lea rcx, [rsp + 0x340]
mov rax, qword [rsp + 0x340]
call qword [rax + 8]
mov rbx, qword [rsp + 0x348]
mov edx, dword [rsp + 0x2f0]
lea rcx, [rsp + 0x2e0]
mov rax, qword [rsp + 0x2e0]
call qword [rax + 8]
mov rcx, qword [0x0046b3e8]
call fcn.00423880
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x2e8]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x0046b3e8]
call fcn.00423820
mov ecx, 9
call fcn.0042adf0
nop
lea rcx, [rsp + 0x510]
mov rax, qword [r13 + 0x527f0]
mov qword [rcx], rax
mov rax, qword [r13 + 0x527f8]
mov qword [rcx + 8], rax
mov eax, dword [r13 + 0x52800]
mov dword [rcx + 0x10], eax
movzx eax, word [r13 + 0x52804]
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x568]
mov rax, qword [r13 + 0x527d0]
mov qword [rcx], rax
mov rax, qword [r13 + 0x527d8]
mov qword [rcx + 8], rax
mov rax, qword [r13 + 0x527e0]
mov qword [rcx + 0x10], rax
movzx eax, word [r13 + 0x527e8]
mov word [rcx + 0x18], ax
movzx eax, byte [r13 + 0x527ea]
mov byte [rcx + 0x1a], al
lea rcx, [rsp + 0x548]
mov rax, qword [r13 + 0x527b0]
mov qword [rcx], rax
mov rax, qword [r13 + 0x527b8]
mov qword [rcx + 8], rax
mov rax, qword [r13 + 0x527c0]
mov qword [rcx + 0x10], rax
movzx eax, word [r13 + 0x527c8]
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x568]
mov rdx, rbx
mov edi, 0x1b
mov r8, rdi
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x4129c0
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00429f40
test rax, rax
je 0x412a20
movzx eax, byte [rbx]
test al, al
js 0x4129f3
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x4129f3
mov al, 0x2e
jmp 0x4129f6
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x004520f0]
call fcn.0042a690
inc rbx
dec rdi
jne 0x4129e1
lea rcx, [0x004520ec]
call fcn.0042a690
lea rbx, [0x0046ad20]
mov rbp, qword [0x0046ad20]
lea rcx, [rsp + 0x548]
mov rdx, rbx
mov edi, 0x1a
mov r8, rdi
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rdx
inc rcx
dec r8
jne 0x412a40
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00429f40
test rax, rax
je 0x412aa0
movzx eax, byte [rbx]
test al, al
js 0x412a73
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x412a73
mov al, 0x2e
jmp 0x412a76
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x004520f0]
call fcn.0042a690
inc rbx
dec rdi
jne 0x412a61
lea rcx, [0x004520ec]
call fcn.0042a690
lea rbx, [0x0046ad20]
mov esi, dword [0x0046ad20]
lea rdx, [rsp + 0x510]
mov r8, rbx
mov edi, 0x16
mov r9, rdi
nop
nop
movzx eax, byte [rdx]
mov byte [r8], al
inc r8
inc rdx
dec r9
jne 0x412ac0
lea rcx, str._JAR2EXE_BINARY_DEBUG_
call fcn.00429f40
test rax, rax
je 0x412b21
movzx eax, byte [rbx]
test al, al
js 0x412af4
movzx eax, byte [rbx]
cmp al, 0x20
jge 0x412af4
mov al, 0x2e
jmp 0x412af7
movzx eax, byte [rbx]
movsx edx, al
lea rcx, [0x004520f0]
call fcn.0042a690
inc rbx
dec rdi
jne 0x412ae2
lea rcx, [0x004520ec]
call fcn.0042a690
lea rbx, [0x0046ad20]
cmp byte [0x0046ad20], 0
je 0x412be6
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.0040ef30
test eax, eax
jne 0x412be6
lea edx, [rax + 0xb]
lea rcx, [rsp + 0x300]
call fcn.0040f0a0
nop
mov edx, 0xa
lea rcx, [rsp + 0x380]
call fcn.0040f0a0
nop
mov edx, dword [rsp + 0x390]
lea rcx, [rsp + 0x380]
mov rax, qword [rsp + 0x380]
call qword [rax + 8]
mov rbx, qword [rsp + 0x388]
mov edx, dword [rsp + 0x310]
lea rcx, [rsp + 0x300]
mov rax, qword [rsp + 0x300]
call qword [rax + 8]
mov rcx, qword [0x0046b3e8]
call fcn.00423880
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x308]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x0046b3e8]
call fcn.00423820
mov ecx, 0xb
call fcn.0042adf0
nop
lea rdx, [rsp + 0xd0]
mov rcx, qword [0x0046ac48]
call fcn.0040c870
nop
mov esi, r12d
nop
inc esi
movsxd rax, esi
cmp byte [rax + r13 + 0x51c94], 0
jne 0x412c00
mov eax, esi
mov edx, dword [rsp + 0xe0]
cmp edx, esi
cmovl eax, edx
mov ebp, r12d
mov rdi, r12
movsxd r13, eax
test eax, eax
jle 0x412c79
lea r15, [0x00400000]
movzx ecx, byte [rdi + r15 + 0x51c94]
mov rax, qword [rsp + 0xd8]
movzx r12d, byte [rax + rdi]
cmp r12b, cl
je 0x412c64
movsx ecx, cl
call fcn.00428b50
mov ebx, eax
movsx ecx, r12b
call fcn.00428b50
cmp eax, ebx
jne 0x412c6e
inc ebp
inc rdi
cmp rdi, r13
jl 0x412c32
test ebp, ebp
js 0x412c8f
mov edx, dword [rsp + 0xe0]
cmp ebp, edx
jge 0x412c96
movsxd rcx, ebp
mov rax, qword [rsp + 0xd8]
movzx r9d, byte [rcx + rax]
jmp 0x412c99
mov edx, dword [rsp + 0xe0]
xor r9b, r9b
test ebp, ebp
mov r15, qword [rsp + 0x148]
js 0x412cbe
cmp ebp, esi
jge 0x412cbe
movsxd rax, ebp
lea r10, [0x00400000]
movzx r8d, byte [rax + r10 + 0x51c94]
jmp 0x412cc8
xor r8b, r8b
lea r10, [0x00400000]
movsx ecx, r9b
movsx eax, r8b
sub ecx, eax
mov r12d, 0
mov eax, r12d
sete al
test eax, eax
je 0x412fcb
lea rdx, [rsp + 0x38]
mov rcx, qword [0x0046ac48]
call fcn.0040c280
nop
mov ebx, dword [rsp + 0x48]
test ebx, ebx
jne 0x412dc1
lea rdx, [rsp + 0x230]
mov rcx, qword [0x0046ac48]
call fcn.00404560
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
call qword [r8 + 8]
movsxd rdi, dword [rbx + 0x10]
mov rsi, qword [rbx + 8]
movsxd rbx, dword [rsp + 0x48]
lea edx, [rbx + rdi]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
cmp ebx, ebx
jge 0x412d68
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rbx]
lea rcx, [rax + rdi]
add rcx, rbx
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.004286b0
mov r8, rdi
mov rcx, rbx
add rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.004286b0
nop
lea rbp, [0x00451660]
mov qword [rsp + 0x230], rbp
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0x238], r12
mov dword [rsp + 0x240], r12d
mov dword [rsp + 0x248], r12d
test rcx, rcx
je 0x412dbb
call fcn.004289f0
mov ebx, dword [rsp + 0x48]
jmp 0x412dc8
mov ebx, dword [rsp + 0x48]
jmp 0x412dc8
lea rbp, [0x00451660]
mov ecx, r12d
mov rax, r12
test ebx, ebx
jle 0x412dee
mov rdx, qword [rsp + 0x40]
cmp byte [rdx + rax], 0x3a
jne 0x412de5
mov byte [rdx + rax], 0x2e
mov ebx, dword [rsp + 0x48]
inc ecx
inc rax
cmp ecx, ebx
jl 0x412dd2
mov ecx, r12d
mov rax, r12
test ebx, ebx
jle 0x412e1c
nop
nop
mov rdx, qword [rsp + 0x40]
cmp byte [rdx + rax], 0x5c
jne 0x412e13
mov byte [rdx + rax], 0x2e
mov ebx, dword [rsp + 0x48]
inc ecx
inc rax
cmp ecx, ebx
jl 0x412e00
lea rsi, str..j2e.mutex
mov qword [rsp + 0x3a8], rsi
lea rax, [0x00451670]
mov qword [rsp + 0x3a0], rax
mov edi, r12d
nop
inc edi
movsxd rax, edi
cmp byte [rax + rsi], 0
jne 0x412e40
mov dword [rsp + 0x3b0], edi
lea edx, [rdi + rbx]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
cmp ebx, ebx
jge 0x412e87
movsxd r8, ebx
mov rax, qword [rsp + 0x40]
lea rdx, [rax + r8]
movsxd rcx, edi
add rcx, rax
add rcx, r8
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.004286b0
movsxd r8, edi
movsxd rcx, ebx
add rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.004286b0
nop
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
jne 0x412ed9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateMutex_error:__d_n
call fcn.0042a690
jmp 0x412efb
mov edx, 0x64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x412f9f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, 0xd
lea rcx, [rsp + 0x360]
call fcn.0040f0a0
nop
mov edx, 0xa
lea rcx, [rsp + 0x320]
call fcn.0040f0a0
nop
mov edx, dword [rsp + 0x330]
lea rcx, [rsp + 0x320]
mov rax, qword [rsp + 0x320]
call qword [rax + 8]
mov rbx, qword [rsp + 0x328]
mov edx, dword [rsp + 0x370]
lea rcx, [rsp + 0x360]
mov rax, qword [rsp + 0x360]
call qword [rax + 8]
mov rcx, qword [0x0046b3e8]
call fcn.00423880
mov rcx, rax
mov r9d, 0x50030
mov r8, rbx
mov rdx, qword [rsp + 0x368]
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 0x64
mov rcx, qword [0x0046b3e8]
call fcn.00423820
mov ecx, 0xb
call fcn.0042adf0
nop
mov qword [rsp + 0x38], rbp
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x50], r12d
test rcx, rcx
je 0x41308f
call fcn.004289f0
jmp 0x41308f
mov ebp, r12d
nop
inc ebp
movsxd rax, ebp
cmp byte [rax + r10 + 0x5277c], r12b
jne 0x412fd0
mov eax, ebp
cmp edx, ebp
cmovl eax, edx
mov esi, r12d
mov rdi, r12
movsxd r13, eax
test eax, eax
jle 0x413040
movzx r12d, byte [rdi + r10 + 0x5277c]
mov rax, qword [rsp + 0xd8]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x41302b
movsx ecx, cl
call fcn.00428b50
mov ebx, eax
movsx ecx, r12b
call fcn.00428b50
cmp ebx, eax
jne 0x413035
lea r10, [0x00400000]
inc esi
inc rdi
cmp rdi, r13
jl 0x412ff3
test esi, esi
js 0x413056
mov edx, dword [rsp + 0xe0]
cmp esi, edx
jge 0x413056
movsxd rcx, esi
mov rax, qword [rsp + 0xd8]
movzx r8d, byte [rcx + rax]
jmp 0x413059
xor r8b, r8b
test esi, esi
js 0x413075
cmp esi, ebp
jge 0x413075
movsxd rax, esi
lea rcx, [0x00400000]
movzx edx, byte [rax + rcx + 0x5277c]
jmp 0x413077
xor dl, dl
movsx ecx, r8b
movsx eax, dl
sub ecx, eax
jne 0x41308c
call fcn.004263a0
xor r12d, r12d
jmp 0x41308f
xor r12d, r12d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x3c0]
call fcn.0040c6c0
nop
mov esi, r12d
lea rcx, [0x00400000]
nop
inc esi
movsxd rax, esi
cmp byte [rax + rcx + 0x51c94], 0
jne 0x4130b0
mov eax, esi
mov edx, dword [rsp + 0x78]
cmp edx, esi
cmovl eax, edx
mov ebp, r12d
mov rdi, r12
movsxd r13, eax
test eax, eax
jle 0x413127
nop
nop
nop
movzx r12d, byte [rdi + rcx + 0x51c94]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x41310e
movsx ecx, cl
call fcn.00428b50
mov ebx, eax
movsx ecx, r12b
call fcn.00428b50
cmp ebx, eax
jne 0x41311f
inc ebp
inc rdi
cmp rdi, r13
lea rcx, [0x00400000]
jl 0x4130e0
test ebp, ebp
js 0x41313a
mov edx, dword [rsp + 0x78]
cmp ebp, edx
jge 0x41313e
movsxd rcx, ebp
mov rax, qword [rsp + 0x70]
movzx r9d, byte [rcx + rax]
jmp 0x413141
mov edx, dword [rsp + 0x78]
xor r9b, r9b
test ebp, ebp
js 0x41315e
cmp ebp, esi
jge 0x41315e
movsxd rax, ebp
lea r10, [0x00400000]
movzx r8d, byte [rax + r10 + 0x51c94]
jmp 0x413168
xor r8b, r8b
lea r10, [0x00400000]
movsx ecx, r9b
movsx eax, r8b
lea r8, [0x00452778]
sub ecx, eax
je 0x41326c
xor esi, esi
nop
nop
nop
nop
inc esi
movsxd rax, esi
cmp byte [rax + r10 + 0x52770], 0
jne 0x413190
mov eax, esi
cmp edx, esi
cmovl eax, edx
xor ebp, ebp
xor edi, edi
movsxd r13, eax
test eax, eax
jle 0x4131f9
movzx r12d, byte [rdi + r10 + 0x52770]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x4131e7
movsx ecx, cl
call fcn.00428b50
mov ebx, eax
movsx ecx, r12b
call fcn.00428b50
cmp ebx, eax
jne 0x4131f1
lea r10, [0x00400000]
inc ebp
inc rdi
cmp rdi, r13
jl 0x4131b2
test ebp, ebp
js 0x41320c
mov edx, dword [rsp + 0x78]
cmp ebp, edx
jge 0x413210
movsxd rcx, ebp
mov rax, qword [rsp + 0x70]
movzx r9d, byte [rcx + rax]
jmp 0x413213
mov edx, dword [rsp + 0x78]
xor r9b, r9b
test ebp, ebp
js 0x413230
cmp ebp, esi
jge 0x413230
movsxd rax, ebp
lea rcx, [0x00400000]
movzx r8d, byte [rax + rcx + 0x52770]
jmp 0x413233
xor r8b, r8b
movsx ecx, r9b
movsx eax, r8b
sub ecx, eax
je 0x413265
lea rdx, [0x00452778]
lea rcx, [rsp + 0x68]
call fcn.00401e00
test eax, eax
jne 0x413362
mov edx, dword [rsp + 0x78]
lea r8, [0x00452778]
jmp 0x41326c
lea r8, [0x00452778]
xor esi, esi
nop
inc esi
movsxd rax, esi
cmp byte [rax + r8], 0
jne 0x413270
mov eax, esi
cmp edx, esi
cmovl eax, edx
xor ebp, ebp
xor edi, edi
movsxd r13, eax
test eax, eax
jle 0x4132d3
nop
movzx r12d, byte [rdi + r8]
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rax + rdi]
cmp cl, r12b
je 0x4132c1
movsx ecx, cl
call fcn.00428b50
mov ebx, eax
movsx ecx, r12b
call fcn.00428b50
cmp ebx, eax
jne 0x4132cb
lea r8, [0x00452778]
inc ebp
inc rdi
cmp rdi, r13
jl 0x413290
test ebp, ebp
js 0x4132e6
mov edx, dword [rsp + 0x78]
cmp ebp, edx
jge 0x4132e6
movsxd rcx, ebp
mov rax, qword [rsp + 0x70]
movzx r8d, byte [rcx + rax]
jmp 0x4132e9
xor r8b, r8b
test ebp, ebp
js 0x413301
cmp ebp, esi
jge 0x413301
movsxd rax, ebp
lea rcx, [0x00452778]
movzx edx, byte [rax + rcx]
jmp 0x413303
xor dl, dl
movsx ecx, r8b
movsx eax, dl
sub ecx, eax
neg ecx
sbb r9d, r9d
add r9d, 2
mov r8, qword [rsp + 0x140]
mov edx, dword [rsp + 0x5c]
lea rcx, [0x0046ac80]
call fcn.00427cb0
lea rdx, [0x00469020]
lea rcx, [0x0046ac80]
call fcn.00427290
mov ebx, dword [0x00469030]
mov edx, ebx
lea rcx, [0x00469020]
mov rax, qword [0x00469020]
call qword [rax + 8]
mov rdi, qword [0x00469028]
jmp 0x41336e
mov ebx, dword [rsp + 0x5c]
mov rdi, qword [rsp + 0x140]
lea rbp, [0x00451660]
mov qword [rsp + 0x68], rbp
mov rcx, qword [rsp + 0x70]
xor esi, esi
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x80], esi
test rcx, rcx
je 0x41339b
call fcn.004289f0
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
lea eax, [rbx - 1]
mov dword [rsp + 0xf0], eax
lea rax, [rdi + 8]
mov qword [rsp + 0xf8], rax
lea rax, [0x0040b690]
mov qword [rsp + 0x100], rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x3c0]
call fcn.0040ba40
nop
cmp dword [rsp + 0x1c0], 0
jne 0x4134e8
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0xf0]
lea r8, [0x004120d0]
xor edx, edx
xor ecx, ecx
call fcn.0042a860
mov rbx, rax
test rax, rax
jne 0x413472
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0xf0]
lea r8, [0x004120d0]
xor edx, edx
xor ecx, ecx
call fcn.0042a860
mov rbx, rax
test rax, rax
je 0x4134a0
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x30]
jmp 0x41352e
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xf0]
call fcn.0040fd40
mov ebx, eax
mov dword [rsp + 0x118], eax
mov rcx, qword [0x0046ac50]
call fcn.00408520
jmp 0x41352e
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xf0]
call fcn.0040fd40
mov ebx, eax
mov dword [rsp + 0x118], eax
mov rcx, qword [0x0046ac50]
call fcn.00408520
mov qword [0x0046ac48], rsi
mov qword [0x0046ac50], rsi
test r14, r14
je 0x413554
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rsp + 0x1b0], rbp
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0x1b8], rsi
mov dword [rsp + 0x1c0], esi
mov dword [rsp + 0x1c8], esi
test rcx, rcx
je 0x413584
call fcn.004289f0
lea rdi, [0x00451630]
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0xd0], rbp
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0xd8], rsi
mov dword [rsp + 0xe0], esi
mov dword [rsp + 0xe8], esi
test rcx, rcx
je 0x4135c3
call fcn.004289f0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x120], rbp
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x128], rsi
mov dword [rsp + 0x130], esi
mov dword [rsp + 0x138], esi
test rcx, rcx
je 0x4135fb
call fcn.004289f0
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0xb0], rbp
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], rsi
mov dword [rsp + 0xc0], esi
mov dword [rsp + 0xc8], esi
test rcx, rcx
je 0x413633
call fcn.004289f0
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x170], rbp
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0x178], rsi
mov dword [rsp + 0x180], esi
mov dword [rsp + 0x188], esi
test rcx, rcx
je 0x41366b
call fcn.004289f0
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x190], rbp
mov rcx, qword [rsp + 0x198]
mov qword [rsp + 0x198], rsi
mov dword [rsp + 0x1a0], esi
mov dword [rsp + 0x1a8], esi
test rcx, rcx
je 0x4136a3
call fcn.004289f0
mov qword [rsp + 0x190], rdi
lea rcx, [rsp + 0x470]
call fcn.00425830
nop
mov qword [rsp + 0x88], rbp
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0x98], esi
mov dword [rsp + 0xa0], esi
test rcx, rcx
je 0x4136e9
call fcn.004289f0
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0x250]
call fcn.00408520
nop
mov qword [rsp + 0x270], rbp
mov rcx, qword [rsp + 0x278]
mov qword [rsp + 0x278], rsi
mov dword [rsp + 0x280], esi
mov dword [rsp + 0x288], esi
test rcx, rcx
je 0x41372f
call fcn.004289f0
mov qword [rsp + 0x270], rdi
lea rax, [0x00451678]
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x258]
mov qword [rsp + 0x258], rsi
mov dword [rsp + 0x260], esi
mov dword [rsp + 0x268], esi
test rcx, rcx
je 0x41376e
call fcn.004289f0
lea rax, [0x00451638]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x3c0]
call fcn.00413ec0
mov eax, ebx
mov rcx, qword [rsp + 0x6a0]
call fcn.00450790
mov rbx, qword [rsp + 0x700]
mov rbp, qword [rsp + 0x708]
mov rsi, qword [rsp + 0x6e0]
mov rdi, qword [rsp + 0x6d8]
mov r12, qword [rsp + 0x6d0]
mov r13, qword [rsp + 0x6c8]
mov r14, qword [rsp + 0x6c0]
mov r15, qword [rsp + 0x6b8]
add rsp, 0x6e8
ret