Function at 0x45a13c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xb
add esp, 0xfffff004
push eax
dec eax
jne 0x45a145
mov eax, dword [ebp - 4]
add esp, 0xfffff9d0
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4b6fc4
mov eax, 0x4a6e48
call fcn.00495388
mov eax, dword [esi + 8]
test eax, eax
je 0x45a1cd
push eax
call sub.KERNEL32.DLL_GlobalSize
mov edi, eax
push edi
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x45a1a0
xor eax, eax
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
jmp 0x45b910
push ebx
call sub.KERNEL32.DLL_GlobalLock
push edi
push dword [esi + 8]
push eax
call fcn.00494d68
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, ebx
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
jmp 0x45b910
mov edx, 0x4c7dc0
mov eax, str.Rar_DRXXXXXX
call fcn.0046e83c
test al, al
jne 0x45a1f4
xor eax, eax
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
jmp 0x45b910
lea ecx, [ebp - 0x9980]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x4c7dc0
call fcn.004968ec
pop ecx
call fcn.0044e674
mov dword [ebp - 0x9574], eax
mov word [ebp - 0x9560], 0x14
mov eax, dword [edi]
mov dword [ebp - 0x4b04], eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x4b00], edx
mov cl, byte [edi + 8]
mov byte [ebp - 0x4afc], cl
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x4af8], eax
push esi
push edi
lea esi, [edi + 0x10]
lea edi, [ebp - 0x4af4]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x410]
lea edi, [ebp - 0x46f4]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x810]
lea edi, [ebp - 0x42f4]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0xc10]
lea edi, [ebp - 0x3ef4]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1410]
lea edi, [ebp - 0x36f4]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x1810]
mov byte [ebp - 0x32f4], al
push esi
push edi
lea esi, [edi + 0x1811]
lea edi, [ebp - 0x32f3]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1c11]
lea edi, [ebp - 0x2ef3]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x1c91]
mov byte [ebp - 0x2e73], al
push esi
push edi
lea esi, [edi + 0x1c92]
lea edi, [ebp - 0x2e72]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2094]
mov dword [ebp - 0x2a70], eax
mov dl, byte [edi + 0x2098]
mov byte [ebp - 0x2a6c], dl
mov ecx, dword [edi + 0x209c]
mov dword [ebp - 0x2a68], ecx
mov eax, dword [edi + 0x20a0]
mov dword [ebp - 0x2a64], eax
mov edx, dword [edi + 0x20a4]
mov dword [ebp - 0x2a60], edx
mov ecx, dword [edi + 0x20a8]
mov dword [ebp - 0x2a5c], ecx
mov al, byte [edi + 0x20ac]
mov byte [ebp - 0x2a58], al
mov dl, byte [edi + 0x20ad]
mov byte [ebp - 0x2a57], dl
mov cl, byte [edi + 0x20ae]
mov byte [ebp - 0x2a56], cl
mov eax, dword [edi + 0x20b0]
mov dword [ebp - 0x2a54], eax
mov edx, dword [edi + 0x20b4]
mov dword [ebp - 0x2a50], edx
mov cl, byte [edi + 0x20b8]
mov byte [ebp - 0x2a4c], cl
mov al, byte [edi + 0x20b9]
mov byte [ebp - 0x2a4b], al
mov dl, byte [edi + 0x20ba]
mov byte [ebp - 0x2a4a], dl
mov cl, byte [edi + 0x20bb]
mov byte [ebp - 0x2a49], cl
mov al, byte [edi + 0x20bc]
mov byte [ebp - 0x2a48], al
mov dl, byte [edi + 0x20bd]
mov byte [ebp - 0x2a47], dl
mov ecx, dword [edi + 0x20c0]
mov dword [ebp - 0x2a44], ecx
mov eax, dword [edi + 0x20c4]
mov dword [ebp - 0x2a40], eax
mov edx, dword [edi + 0x20c8]
mov dword [ebp - 0x2a3c], edx
mov edx, dword [edi + 0x20cc]
mov dword [ebp - 0x2a38], edx
mov ecx, dword [edi + 0x20d0]
mov dword [ebp - 0x2a34], ecx
mov eax, dword [edi + 0x20d4]
mov dword [ebp - 0x2a30], eax
mov edx, dword [edi + 0x20d8]
mov dword [ebp - 0x2a2c], edx
inc dword [ebp - 0x9554]
mov ecx, dword [edi + 0x20dc]
mov dword [ebp - 0x2a28], ecx
mov al, byte [edi + 0x20e0]
mov byte [ebp - 0x2a24], al
mov dl, byte [edi + 0x20e1]
mov byte [ebp - 0x2a23], dl
mov cl, byte [edi + 0x20e2]
mov byte [ebp - 0x2a22], cl
mov eax, dword [edi + 0x20e4]
mov dword [ebp - 0x2a20], eax
mov edx, dword [edi + 0x20e8]
mov dword [ebp - 0x2a1c], edx
mov cl, byte [edi + 0x20ec]
mov byte [ebp - 0x2a18], cl
mov al, byte [edi + 0x20ed]
mov byte [ebp - 0x2a17], al
mov edx, dword [edi + 0x20f0]
mov dword [ebp - 0x2a14], edx
mov ecx, dword [edi + 0x20f4]
mov dword [ebp - 0x2a10], ecx
mov al, byte [edi + 0x20f8]
mov byte [ebp - 0x2a0c], al
mov dl, byte [edi + 0x20f9]
mov byte [ebp - 0x2a0b], dl
mov cl, byte [edi + 0x20fa]
mov byte [ebp - 0x2a0a], cl
mov al, byte [edi + 0x20fb]
mov byte [ebp - 0x2a09], al
mov dl, byte [edi + 0x20fc]
mov byte [ebp - 0x2a08], dl
mov cl, byte [edi + 0x20fd]
mov byte [ebp - 0x2a07], cl
mov al, byte [edi + 0x20fe]
mov byte [ebp - 0x2a06], al
push esi
push edi
lea esi, [edi + 0x20ff]
lea edi, [ebp - 0x2a05]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x214f]
mov byte [ebp - 0x29b5], al
mov dl, byte [edi + 0x2150]
mov byte [ebp - 0x29b4], dl
mov cl, byte [edi + 0x2151]
mov byte [ebp - 0x29b3], cl
mov eax, dword [edi + 0x2154]
mov dword [ebp - 0x29b0], eax
mov edx, dword [edi + 0x2158]
mov dword [ebp - 0x29ac], edx
push esi
push edi
lea esi, [edi + 0x215c]
lea edi, [ebp - 0x29a8]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2180]
mov dword [ebp - 0x2984], eax
mov eax, dword [edi + 0x2184]
mov dword [ebp - 0x2980], eax
push esi
push edi
lea esi, [edi + 0x2188]
lea edi, [ebp - 0x297c]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x21ac]
mov dword [ebp - 0x2958], eax
mov eax, dword [edi + 0x21b0]
mov dword [ebp - 0x2954], eax
mov edx, dword [edi + 0x21b4]
mov dword [ebp - 0x2950], edx
mov edx, dword [edi + 0x21b8]
mov dword [ebp - 0x294c], edx
mov ecx, dword [edi + 0x21bc]
mov dword [ebp - 0x2948], ecx
mov ecx, dword [edi + 0x21c0]
mov dword [ebp - 0x2944], ecx
mov al, byte [edi + 0x21c4]
mov byte [ebp - 0x2940], al
mov dl, byte [edi + 0x21c5]
mov byte [ebp - 0x293f], dl
mov cl, byte [edi + 0x21c6]
mov byte [ebp - 0x293e], cl
mov al, byte [edi + 0x21c7]
mov byte [ebp - 0x293d], al
push esi
push edi
lea esi, [edi + 0x21c8]
lea edi, [ebp - 0x293c]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2288]
lea edi, [ebp - 0x287c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2688]
mov dword [ebp - 0x247c], eax
mov dl, byte [edi + 0x268c]
mov byte [ebp - 0x2478], dl
mov cl, byte [edi + 0x268d]
mov byte [ebp - 0x2477], cl
mov al, byte [edi + 0x268e]
mov byte [ebp - 0x2476], al
mov edx, dword [edi + 0x2690]
mov dword [ebp - 0x2474], edx
mov ecx, dword [edi + 0x2694]
mov dword [ebp - 0x2470], ecx
mov eax, dword [edi + 0x2698]
mov dword [ebp - 0x246c], eax
mov edx, dword [edi + 0x269c]
mov dword [ebp - 0x2468], edx
push esi
push edi
lea esi, [edi + 0x26a0]
lea edi, [ebp - 0x2464]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2aa0]
mov dword [ebp - 0x2064], eax
mov dl, byte [edi + 0x2aa4]
mov byte [ebp - 0x2060], dl
mov cl, byte [edi + 0x2aa5]
mov byte [ebp - 0x205f], cl
mov al, byte [edi + 0x2aa6]
mov byte [ebp - 0x205e], al
mov edx, dword [edi + 0x2aa8]
mov dword [ebp - 0x205c], edx
mov cl, byte [edi + 0x2aac]
mov byte [ebp - 0x2058], cl
push esi
push edi
lea esi, [edi + 0x2aad]
lea edi, [ebp - 0x2057]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2ead]
lea edi, [ebp - 0x1c57]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x32ad]
mov byte [ebp - 0x1857], al
mov dl, byte [edi + 0x32ae]
mov byte [ebp - 0x1856], dl
mov cl, byte [edi + 0x32af]
mov byte [ebp - 0x1855], cl
mov eax, dword [edi + 0x32b0]
mov dword [ebp - 0x1854], eax
mov dl, byte [edi + 0x32b4]
mov byte [ebp - 0x1850], dl
mov cl, byte [edi + 0x32b5]
mov byte [ebp - 0x184f], cl
mov eax, dword [edi + 0x32b8]
mov dword [ebp - 0x184c], eax
inc dword [ebp - 0x9554]
mov dl, byte [edi + 0x32bc]
mov byte [ebp - 0x1848], dl
mov cl, byte [edi + 0x32bd]
mov byte [ebp - 0x1847], cl
mov ecx, 0x104
mov al, byte [edi + 0x32be]
mov byte [ebp - 0x1846], al
mov dl, byte [edi + 0x32bf]
mov byte [ebp - 0x1845], dl
push esi
push edi
lea esi, [edi + 0x32c0]
lea edi, [ebp - 0x1844]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x36d0]
lea edi, [ebp - 0x1434]
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x3ef0]
lea edi, [ebp - 0xc14]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x42f0]
lea edi, [ebp - 0x814]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x4af0]
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [edi + 0x4af4]
mov dword [ebp - 0x10], edx
mov ecx, dword [edi + 0x4af8]
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x4afc]
mov dword [ebp - 8], eax
lea eax, [edi + 0x20d0]
mov edx, dword [edi + 0x4b00]
mov dword [ebp - 4], edx
lea edx, [ebx + 0x20d0]
inc dword [ebp - 0x9554]
mov word [ebp - 0x9560], 8
call fcn.0040dd20
lea ecx, [ebx + 0x215c]
mov dword [ebp - 0x9578], ecx
mov ecx, 9
mov eax, dword [ebp - 0x9578]
push esi
push edi
mov esi, eax
add edi, 0x215c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9578]
pop edi
pop esi
lea ecx, [ebx + 0x2188]
mov edx, dword [eax + 0x24]
mov dword [edi + 0x2180], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x2184], edx
mov dword [ebp - 0x957c], ecx
mov eax, dword [ebp - 0x957c]
push esi
push edi
mov esi, eax
add edi, 0x2188
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x957c]
pop edi
pop esi
mov edx, dword [eax + 0x24]
mov dword [edi + 0x21ac], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x21b0], edx
mov ecx, dword [ebx]
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dl, byte [ebx + 8]
mov byte [edi + 8], dl
mov ecx, dword [ebx + 0xc]
mov dword [edi + 0xc], ecx
push esi
push edi
lea esi, [ebx + 0x10]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x410]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x810]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0xc10]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1410]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov al, byte [ebx + 0x1810]
pop esi
mov ecx, 0x100
mov byte [edi + 0x1810], al
push esi
push edi
lea esi, [ebx + 0x1811]
add edi, 0x1811
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1c11]
add edi, 0x1c11
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x1c91]
mov ecx, 0x100
mov byte [edi + 0x1c91], al
push esi
push edi
lea esi, [ebx + 0x1c92]
add edi, 0x1c92
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x2094]
mov dword [edi + 0x2094], eax
mov dl, byte [ebx + 0x2098]
mov byte [edi + 0x2098], dl
mov ecx, dword [ebx + 0x209c]
mov dword [edi + 0x209c], ecx
mov eax, dword [ebx + 0x20a0]
mov dword [edi + 0x20a0], eax
mov edx, dword [ebx + 0x20a4]
mov dword [edi + 0x20a4], edx
mov ecx, dword [ebx + 0x20a8]
mov dword [edi + 0x20a8], ecx
mov al, byte [ebx + 0x20ac]
mov byte [edi + 0x20ac], al
mov dl, byte [ebx + 0x20ad]
mov byte [edi + 0x20ad], dl
mov cl, byte [ebx + 0x20ae]
mov byte [edi + 0x20ae], cl
mov eax, dword [ebx + 0x20b0]
mov dword [edi + 0x20b0], eax
mov edx, dword [ebx + 0x20b4]
mov dword [edi + 0x20b4], edx
mov cl, byte [ebx + 0x20b8]
mov byte [edi + 0x20b8], cl
mov al, byte [ebx + 0x20b9]
mov byte [edi + 0x20b9], al
mov dl, byte [ebx + 0x20ba]
mov byte [edi + 0x20ba], dl
mov cl, byte [ebx + 0x20bb]
mov byte [edi + 0x20bb], cl
mov al, byte [ebx + 0x20bc]
mov byte [edi + 0x20bc], al
mov dl, byte [ebx + 0x20bd]
mov byte [edi + 0x20bd], dl
mov ecx, dword [ebx + 0x20c0]
mov dword [edi + 0x20c0], ecx
mov eax, dword [ebx + 0x20c4]
mov dword [edi + 0x20c4], eax
mov edx, dword [ebx + 0x20c8]
mov dword [edi + 0x20c8], edx
mov edx, dword [ebx + 0x20cc]
mov dword [edi + 0x20cc], edx
mov ecx, dword [ebx + 0x20dc]
mov dword [edi + 0x20dc], ecx
mov al, byte [ebx + 0x20e0]
mov byte [edi + 0x20e0], al
mov dl, byte [ebx + 0x20e1]
mov byte [edi + 0x20e1], dl
mov cl, byte [ebx + 0x20e2]
mov byte [edi + 0x20e2], cl
mov eax, dword [ebx + 0x20e4]
mov dword [edi + 0x20e4], eax
mov edx, dword [ebx + 0x20e8]
mov dword [edi + 0x20e8], edx
mov cl, byte [ebx + 0x20ec]
mov byte [edi + 0x20ec], cl
mov al, byte [ebx + 0x20ed]
mov byte [edi + 0x20ed], al
mov edx, dword [ebx + 0x20f0]
mov dword [edi + 0x20f0], edx
mov ecx, dword [ebx + 0x20f4]
mov dword [edi + 0x20f4], ecx
mov al, byte [ebx + 0x20f8]
mov byte [edi + 0x20f8], al
mov dl, byte [ebx + 0x20f9]
mov byte [edi + 0x20f9], dl
mov cl, byte [ebx + 0x20fa]
mov byte [edi + 0x20fa], cl
mov al, byte [ebx + 0x20fb]
mov byte [edi + 0x20fb], al
mov dl, byte [ebx + 0x20fc]
mov byte [edi + 0x20fc], dl
mov cl, byte [ebx + 0x20fd]
mov byte [edi + 0x20fd], cl
mov ecx, 0x14
mov al, byte [ebx + 0x20fe]
mov byte [edi + 0x20fe], al
push esi
push edi
lea esi, [ebx + 0x20ff]
add edi, 0x20ff
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x214f]
mov byte [edi + 0x214f], al
mov dl, byte [ebx + 0x2150]
mov byte [edi + 0x2150], dl
mov cl, byte [ebx + 0x2151]
mov byte [edi + 0x2151], cl
mov eax, dword [ebx + 0x2154]
mov dword [edi + 0x2154], eax
mov edx, dword [ebx + 0x2158]
mov dword [edi + 0x2158], edx
mov ecx, dword [ebx + 0x21b4]
mov dword [edi + 0x21b4], ecx
mov ecx, dword [ebx + 0x21b8]
mov dword [edi + 0x21b8], ecx
mov eax, dword [ebx + 0x21bc]
mov dword [edi + 0x21bc], eax
mov eax, dword [ebx + 0x21c0]
mov dword [edi + 0x21c0], eax
mov dl, byte [ebx + 0x21c4]
mov byte [edi + 0x21c4], dl
mov cl, byte [ebx + 0x21c5]
mov byte [edi + 0x21c5], cl
mov ecx, 0x30
mov al, byte [ebx + 0x21c6]
mov byte [edi + 0x21c6], al
mov dl, byte [ebx + 0x21c7]
mov byte [edi + 0x21c7], dl
push esi
push edi
lea esi, [ebx + 0x21c8]
add edi, 0x21c8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2288]
add edi, 0x2288
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2688]
pop esi
mov dword [edi + 0x2688], eax
mov dl, byte [ebx + 0x268c]
mov byte [edi + 0x268c], dl
mov cl, byte [ebx + 0x268d]
mov byte [edi + 0x268d], cl
mov al, byte [ebx + 0x268e]
mov byte [edi + 0x268e], al
mov edx, dword [ebx + 0x2690]
mov dword [edi + 0x2690], edx
mov ecx, dword [ebx + 0x2694]
mov dword [edi + 0x2694], ecx
mov ecx, 0x100
mov eax, dword [ebx + 0x2698]
mov dword [edi + 0x2698], eax
mov edx, dword [ebx + 0x269c]
mov dword [edi + 0x269c], edx
push esi
push edi
add edi, 0x26a0
lea esi, [ebx + 0x26a0]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2aa0]
pop esi
mov dword [edi + 0x2aa0], eax
mov dl, byte [ebx + 0x2aa4]
mov byte [edi + 0x2aa4], dl
mov cl, byte [ebx + 0x2aa5]
mov byte [edi + 0x2aa5], cl
mov al, byte [ebx + 0x2aa6]
mov byte [edi + 0x2aa6], al
mov edx, dword [ebx + 0x2aa8]
mov dword [edi + 0x2aa8], edx
mov cl, byte [ebx + 0x2aac]
mov byte [edi + 0x2aac], cl
push esi
push edi
lea esi, [ebx + 0x2aad]
add edi, 0x2aad
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2ead]
add edi, 0x2ead
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x32ad]
mov byte [edi + 0x32ad], al
mov dl, byte [ebx + 0x32ae]
mov byte [edi + 0x32ae], dl
mov cl, byte [ebx + 0x32af]
mov byte [edi + 0x32af], cl
mov eax, dword [ebx + 0x32b0]
mov dword [edi + 0x32b0], eax
mov dl, byte [ebx + 0x32b4]
mov byte [edi + 0x32b4], dl
mov cl, byte [ebx + 0x32b5]
mov byte [edi + 0x32b5], cl
mov eax, dword [ebx + 0x32b8]
mov dword [edi + 0x32b8], eax
mov dl, byte [ebx + 0x32bc]
mov byte [edi + 0x32bc], dl
mov cl, byte [ebx + 0x32bd]
mov byte [edi + 0x32bd], cl
mov ecx, 0x104
mov al, byte [ebx + 0x32be]
mov byte [edi + 0x32be], al
mov dl, byte [ebx + 0x32bf]
mov byte [edi + 0x32bf], dl
push esi
push edi
lea esi, [ebx + 0x32c0]
add edi, 0x32c0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x36d0]
add edi, 0x36d0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x3ef0]
add edi, 0x3ef0
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x42f0]
add edi, 0x42f0
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x4af0]
mov dword [edi + 0x4af0], eax
mov edx, dword [ebx + 0x4af4]
mov dword [edi + 0x4af4], edx
mov ecx, dword [ebx + 0x4af8]
mov dword [edi + 0x4af8], ecx
xor ecx, ecx
mov eax, dword [ebx + 0x4afc]
mov dword [edi + 0x4afc], eax
mov eax, 0x4c319c
mov edx, dword [ebx + 0x4b00]
mov dword [edi + 0x4b00], edx
xor edx, edx
call fcn.0045d718
lea edx, [ebp - 0x2a34]
lea eax, [edi + 0x20d0]
call fcn.0040dd20
push esi
push edi
lea esi, [ebp - 0x29a8]
add edi, 0x215c
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2984]
mov dword [edi + 0x2180], eax
mov eax, dword [ebp - 0x2980]
mov dword [edi + 0x2184], eax
push esi
push edi
lea esi, [ebp - 0x297c]
add edi, 0x2188
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2958]
mov dword [edi + 0x21ac], eax
mov eax, dword [ebp - 0x2954]
mov dword [edi + 0x21b0], eax
mov edx, dword [ebp - 0x4b04]
mov dword [edi], edx
mov ecx, dword [ebp - 0x4b00]
mov dword [edi + 4], ecx
mov al, byte [ebp - 0x4afc]
mov byte [edi + 8], al
mov edx, dword [ebp - 0x4af8]
mov dword [edi + 0xc], edx
push esi
push edi
lea esi, [ebp - 0x4af4]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x46f4]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x42f4]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x3ef4]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x36f4]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x32f4]
mov byte [edi + 0x1810], al
push esi
push edi
lea esi, [ebp - 0x32f3]
add edi, 0x1811
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2ef3]
add edi, 0x1c11
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x2e73]
mov byte [edi + 0x1c91], al
push esi
push edi
lea esi, [ebp - 0x2e72]
add edi, 0x1c92
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2a70]
mov dword [edi + 0x2094], eax
mov dl, byte [ebp - 0x2a6c]
mov byte [edi + 0x2098], dl
mov ecx, dword [ebp - 0x2a68]
mov dword [edi + 0x209c], ecx
mov eax, dword [ebp - 0x2a64]
mov dword [edi + 0x20a0], eax
mov edx, dword [ebp - 0x2a60]
mov dword [edi + 0x20a4], edx
mov ecx, dword [ebp - 0x2a5c]
mov dword [edi + 0x20a8], ecx
mov al, byte [ebp - 0x2a58]
mov byte [edi + 0x20ac], al
mov dl, byte [ebp - 0x2a57]
mov byte [edi + 0x20ad], dl
mov cl, byte [ebp - 0x2a56]
mov byte [edi + 0x20ae], cl
mov eax, dword [ebp - 0x2a54]
mov dword [edi + 0x20b0], eax
mov edx, dword [ebp - 0x2a50]
mov dword [edi + 0x20b4], edx
mov cl, byte [ebp - 0x2a4c]
mov byte [edi + 0x20b8], cl
mov al, byte [ebp - 0x2a4b]
mov byte [edi + 0x20b9], al
mov dl, byte [ebp - 0x2a4a]
mov byte [edi + 0x20ba], dl
mov cl, byte [ebp - 0x2a49]
mov byte [edi + 0x20bb], cl
mov al, byte [ebp - 0x2a48]
mov byte [edi + 0x20bc], al
mov dl, byte [ebp - 0x2a47]
mov byte [edi + 0x20bd], dl
mov ecx, dword [ebp - 0x2a44]
mov dword [edi + 0x20c0], ecx
mov eax, dword [ebp - 0x2a40]
mov dword [edi + 0x20c4], eax
mov edx, dword [ebp - 0x2a3c]
mov dword [edi + 0x20c8], edx
mov edx, dword [ebp - 0x2a38]
mov dword [edi + 0x20cc], edx
mov ecx, dword [ebp - 0x2a28]
mov dword [edi + 0x20dc], ecx
mov al, byte [ebp - 0x2a24]
mov byte [edi + 0x20e0], al
mov dl, byte [ebp - 0x2a23]
mov byte [edi + 0x20e1], dl
mov cl, byte [ebp - 0x2a22]
mov byte [edi + 0x20e2], cl
mov eax, dword [ebp - 0x2a20]
mov dword [edi + 0x20e4], eax
mov edx, dword [ebp - 0x2a1c]
mov dword [edi + 0x20e8], edx
mov cl, byte [ebp - 0x2a18]
mov byte [edi + 0x20ec], cl
mov al, byte [ebp - 0x2a17]
mov byte [edi + 0x20ed], al
mov edx, dword [ebp - 0x2a14]
mov dword [edi + 0x20f0], edx
mov ecx, dword [ebp - 0x2a10]
mov dword [edi + 0x20f4], ecx
mov al, byte [ebp - 0x2a0c]
mov byte [edi + 0x20f8], al
mov dl, byte [ebp - 0x2a0b]
mov byte [edi + 0x20f9], dl
mov cl, byte [ebp - 0x2a0a]
mov byte [edi + 0x20fa], cl
mov al, byte [ebp - 0x2a09]
mov byte [edi + 0x20fb], al
mov dl, byte [ebp - 0x2a08]
mov byte [edi + 0x20fc], dl
mov cl, byte [ebp - 0x2a07]
mov byte [edi + 0x20fd], cl
mov al, byte [ebp - 0x2a06]
mov byte [edi + 0x20fe], al
push esi
push edi
lea esi, [ebp - 0x2a05]
add edi, 0x20ff
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x29b5]
mov byte [edi + 0x214f], al
mov dl, byte [ebp - 0x29b4]
mov byte [edi + 0x2150], dl
mov cl, byte [ebp - 0x29b3]
mov byte [edi + 0x2151], cl
mov eax, dword [ebp - 0x29b0]
mov dword [edi + 0x2154], eax
mov edx, dword [ebp - 0x29ac]
mov dword [edi + 0x2158], edx
mov ecx, dword [ebp - 0x2950]
mov dword [edi + 0x21b4], ecx
mov ecx, dword [ebp - 0x294c]
mov dword [edi + 0x21b8], ecx
mov eax, dword [ebp - 0x2948]
mov dword [edi + 0x21bc], eax
mov eax, dword [ebp - 0x2944]
mov dword [edi + 0x21c0], eax
mov dl, byte [ebp - 0x2940]
mov byte [edi + 0x21c4], dl
mov cl, byte [ebp - 0x293f]
mov byte [edi + 0x21c5], cl
mov al, byte [ebp - 0x293e]
mov byte [edi + 0x21c6], al
mov dl, byte [ebp - 0x293d]
mov byte [edi + 0x21c7], dl
push esi
push edi
lea esi, [ebp - 0x293c]
add edi, 0x21c8
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x287c]
add edi, 0x2288
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x247c]
mov dword [edi + 0x2688], eax
mov dl, byte [ebp - 0x2478]
mov byte [edi + 0x268c], dl
mov cl, byte [ebp - 0x2477]
mov byte [edi + 0x268d], cl
mov al, byte [ebp - 0x2476]
mov byte [edi + 0x268e], al
mov edx, dword [ebp - 0x2474]
mov dword [edi + 0x2690], edx
mov ecx, dword [ebp - 0x2470]
mov dword [edi + 0x2694], ecx
mov eax, dword [ebp - 0x246c]
mov dword [edi + 0x2698], eax
mov edx, dword [ebp - 0x2468]
mov dword [edi + 0x269c], edx
push esi
push edi
lea esi, [ebp - 0x2464]
add edi, 0x26a0
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2064]
mov dword [edi + 0x2aa0], eax
mov dl, byte [ebp - 0x2060]
mov byte [edi + 0x2aa4], dl
mov cl, byte [ebp - 0x205f]
mov byte [edi + 0x2aa5], cl
mov al, byte [ebp - 0x205e]
mov byte [edi + 0x2aa6], al
mov edx, dword [ebp - 0x205c]
mov dword [edi + 0x2aa8], edx
mov cl, byte [ebp - 0x2058]
mov byte [edi + 0x2aac], cl
push esi
push edi
lea esi, [ebp - 0x2057]
add edi, 0x2aad
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1c57]
add edi, 0x2ead
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x1857]
mov byte [edi + 0x32ad], al
mov dl, byte [ebp - 0x1856]
mov byte [edi + 0x32ae], dl
mov cl, byte [ebp - 0x1855]
mov byte [edi + 0x32af], cl
mov eax, dword [ebp - 0x1854]
mov dword [edi + 0x32b0], eax
mov dl, byte [ebp - 0x1850]
mov byte [edi + 0x32b4], dl
mov cl, byte [ebp - 0x184f]
mov byte [edi + 0x32b5], cl
mov eax, dword [ebp - 0x184c]
mov dword [edi + 0x32b8], eax
mov dl, byte [ebp - 0x1848]
mov byte [edi + 0x32bc], dl
mov cl, byte [ebp - 0x1847]
mov byte [edi + 0x32bd], cl
mov al, byte [ebp - 0x1846]
mov byte [edi + 0x32be], al
mov dl, byte [ebp - 0x1845]
mov byte [edi + 0x32bf], dl
push esi
push edi
lea esi, [ebp - 0x1844]
add edi, 0x32c0
mov ecx, 0x104
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1434]
add edi, 0x36d0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0xc14]
add edi, 0x3ef0
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x814]
add edi, 0x42f0
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x4af0], eax
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x4af4], edx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x4af8], ecx
mov eax, dword [ebp - 8]
mov dword [edi + 0x4afc], eax
mov edx, dword [ebp - 4]
mov dword [edi + 0x4b00], edx
push 0x4b04
push 0
lea ecx, [ebp - 0x4b04]
push ecx
call fcn.00494dd8
add esp, 0xc
call fcn.0044e674
cmp eax, dword [ebp - 0x9574]
jne 0x45b4b0
cmp dword [0x4c4df4], 0
je 0x45b4b4
xor eax, eax
jmp 0x45b4b9
mov eax, 1
test al, al
jne 0x45b4c4
mov byte [0x4c7dbe], 0
lea edx, [ebp - 0x9d80]
mov eax, 0x4c319c
xor ecx, ecx
call fcn.004626e4
cmp byte [ebp - 0x9d80], 0
je 0x45b4fd
lea edx, [ebp - 0x9d80]
lea eax, [ebp - 0x9d80]
call fcn.0040bb70
lea edx, [ebp - 0x9d80]
push edx
call fcn.004968ec
pop ecx
mov word [ebp - 0x9560], 0x20
lea eax, [ebp - 0x4bfc]
call fcn.0040f5f8
add dword [ebp - 0x9554], 4
mov word [ebp - 0x9560], 8
mov word [ebp - 0x9560], 0x2c
mov word [ebp - 0x9560], 0x38
lea eax, [ebp - 0x4cf4]
call fcn.0040f5f8
add dword [ebp - 0x9554], 4
mov word [ebp - 0x9560], 0x44
mov edx, 0x4a6c7d
lea eax, [ebp - 0x4cf4]
call fcn.0040f77c
lea eax, [ebp - 0xa220]
call fcn.004137a4
lea eax, [ebp - 0xa1f4]
call fcn.004137a4
lea eax, [ebp - 0xa1c8]
call fcn.004137a4
mov word [ebp - 0x9560], 0x50
push 0
push 3
lea edx, [ebp - 0x4cf4]
lea eax, [ebp - 0x7120]
xor ecx, ecx
call fcn.00412cdc
inc dword [ebp - 0x9554]
mov word [ebp - 0x9560], 0x44
xor ebx, ebx
jmp 0x45b5e8
lea edx, [ebp - 0xb234]
lea eax, [ebp - 0xae34]
call fcn.0040a9a4
lea edx, [ebp - 0xb234]
lea eax, [ebp - 0x4bfc]
call fcn.0040f77c
lea ecx, [ebp - 0xb234]
push ecx
call fcn.00494f88
pop ecx
add eax, ebx
add eax, 3
mov ebx, eax
lea edx, [ebp - 0xae34]
lea eax, [ebp - 0x7120]
call fcn.00412e10
test eax, eax
je 0x45b5b2
test ebx, ebx
jne 0x45b672
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7120]
dec dword [ebp - 0x9554]
call fcn.00412db4
sub dword [ebp - 0x9554], 4
lea eax, [ebp - 0x4cf4]
mov edx, 2
call fcn.0040f6d0
sub dword [ebp - 0x9554], 4
lea eax, [ebp - 0x4bfc]
mov edx, 2
call fcn.0040f6d0
sub dword [ebp - 0x9554], 3
lea eax, [ebp - 0x4b04]
mov edx, 2
call fcn.00425d6c
pop eax
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
jmp 0x45b910
add ebx, 0x15
push ebx
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x9580], eax
cmp dword [ebp - 0x9580], 0
jne 0x45b700
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7120]
dec dword [ebp - 0x9554]
call fcn.00412db4
sub dword [ebp - 0x9554], 4
lea eax, [ebp - 0x4cf4]
mov edx, 2
call fcn.0040f6d0
sub dword [ebp - 0x9554], 4
lea eax, [ebp - 0x4bfc]
mov edx, 2
call fcn.0040f6d0
sub dword [ebp - 0x9554], 3
lea eax, [ebp - 0x4b04]
mov edx, 2
call fcn.00425d6c
pop eax
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
jmp 0x45b910
lea eax, [ebp - 0x4cf4]
call fcn.0040f944
mov word [ebp - 0x9560], 0x5c
push 0
push 1
lea edx, [ebp - 0x4cf4]
lea eax, [ebp - 0x954c]
mov ecx, 1
call fcn.00412cdc
inc dword [ebp - 0x9554]
mov word [ebp - 0x9560], 0x44
jmp 0x45b751
test byte [ebp - 0xa22c], 5
je 0x45b751
mov byte [esi + 0x4f11], 0
jmp 0x45b766
lea edx, [ebp - 0xae34]
lea eax, [ebp - 0x954c]
call fcn.00412e10
test eax, eax
je 0x45b73f
dec dword [ebp - 0x9554]
lea eax, [ebp - 0x954c]
mov edx, 2
call fcn.00412db4
dec dword [ebp - 0x9554]
lea eax, [ebp - 0x7120]
mov edx, 2
call fcn.00412db4
sub dword [ebp - 0x9554], 4
lea eax, [ebp - 0x4cf4]
mov edx, 2
call fcn.0040f6d0
mov word [ebp - 0x9560], 0x2c
mov word [ebp - 0x9560], 8
jmp 0x45b819
push dword [ebp - 0x9580]
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
mov word [ebp - 0x9560], 8
mov dword [edi], 0x14
xor eax, eax
mov dword [edi + 0x10], eax
mov ebx, 0x14
jmp 0x45b863
lea eax, [ebp - 0xb634]
push eax
lea edx, [ebx + edi]
push edx
call sub.KERNEL32.DLL_lstrcpyA
lea ecx, [ebp - 0xb634]
push ecx
call fcn.00494f88
pop ecx
add eax, ebx
inc eax
mov ebx, eax
lea edx, [ebp - 0xb634]
lea eax, [ebp - 0x4bfc]
mov ecx, 0x400
call fcn.0040f800
test al, al
jne 0x45b841
mov byte [edi + ebx], 0
lea eax, [ebp - 0x9980]
push eax
call fcn.004968ec
pop ecx
push dword [ebp - 0x9580]
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov word [ebp - 0x9560], 8
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x45b8c2
push ebx
push edi
push dword [esi + 8]
call fcn.00494d68
add esp, 0xc
push dword [ebp - 0x9580]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 0x9580]
mov edx, 2
push eax
lea eax, [ebp - 0x4bfc]
sub dword [ebp - 0x9554], 4
call fcn.0040f6d0
sub dword [ebp - 0x9554], 3
lea eax, [ebp - 0x4b04]
mov edx, 2
call fcn.00425d6c
pop eax
mov edx, dword [ebp - 0x9570]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret