Function at 0x4a2b40
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x550
call 0x4a2b54
pop eax
mov esi, edx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x128], eax
movzx eax, byte [edx + 0x54]
mov edx, dword [edx + 0x50]
test edx, edx
setne cl
or cl, al
je 0x4a2d09
test al, al
mov dword [esp + 0x104], 0
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10c], 0
jne 0x4a2d43
call sub.kernel32.dll_GetEnvironmentStringsW
test eax, eax
je 0x4a6803
lea edi, [esp + 0xa0]
lea esi, [esp + 0xc4]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
nop
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.004a0e20
add esp, 8
mov ecx, dword [esp + 0x14c]
mov eax, ecx
neg eax
jo 0x4a2d33
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x15c]
movq xmm0, qword [esp + 0x154]
mov ebx, dword [esp + 0x150]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x160]
movd eax, xmm0
mov dword [esp + 0xc4], ebx
movdqa xmmword [esp + 0xf0], xmm0
add eax, ebx
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x164]
mov word [esp + 0xcc], 0
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x168]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
mov ecx, edi
mov edx, esi
call fcn.00478e80
mov eax, dword [esp + 0x18]
movaps xmm0, xmmword [esp + 0xf0]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x40], ebx
movlps qword [esp + 0x44], xmm0
movq xmm0, qword [esp + 0xa0]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
movq qword [ecx], xmm0
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xcc], eax
lea edx, [esp + 0x104]
mov ecx, edi
push esi
lea eax, [esp + 0x40]
push eax
call fcn.00468d20
add esp, 8
mov eax, dword [esp + 0xa0]
test eax, 0x7fffffff
je 0x4a2bd0
push 1
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
jmp 0x4a2bd0
mov dword [esp + 0x130], 0
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x134]
mov edi, dword [esi + 0x20]
test edi, edi
jne 0x4a34ef
jmp 0x4a3544
push dword [esp + 0x90]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov esi, dword [esp + 0x2c]
xor edx, edx
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0xa0], edx
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], esi
jmp 0x4a2dc0
push 1
push eax
push dword [esp + 0xd0]
call fcn.0040cd20
add esp, 0xc
nop word cs:[eax + eax]
nop dword [eax]
lea ecx, [esp + 0xa0]
call fcn.0045cf40
mov edi, eax
test eax, eax
je 0x4a3313
xor eax, eax
cmp eax, dword [edx]
jno 0x4a3050
mov ebx, dword [esp + 0x104]
test ebx, ebx
je 0x4a2dc0
mov esi, dword [esp + 0x108]
mov edx, ebx
lea ecx, [esp + 0x90]
push dword [edi + 0x18]
push dword [edi + 0x14]
push esi
call fcn.0046d090
add esp, 0xc
cmp dword [esp + 0x90], 1
je 0x4a2dc0
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x9c]
mov byte [esp + 0x114], 0
test ecx, ecx
je 0x4a31ec
nop dword [eax]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
je 0x4a2e5b
movzx edx, word [eax + 0x1ea]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
jne 0x4a2e4a
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], 0
dec ecx
mov dword [esp + 0x124], ecx
lea edx, [esp + 0x11c]
lea eax, [esp + 0x114]
lea ecx, [esp + 0x14c]
push eax
call fcn.0046c250
add esp, 4
movsd xmm2, qword [esp + 0x164]
movsd xmm1, qword [esp + 0x15c]
mov eax, dword [esp + 0x174]
movq xmm0, qword [esp + 0x16c]
mov ecx, dword [esp + 0x180]
movsd qword [esp + 0xdc], xmm2
movsd qword [esp + 0xd4], xmm1
movsd xmm2, qword [esp + 0x14c]
movsd xmm1, qword [esp + 0x154]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x178]
movq qword [esp + 0xe4], xmm0
movsd qword [esp + 0xcc], xmm1
movsd qword [esp + 0xc4], xmm2
movzx edx, word [eax + 0x1ea]
cmp ecx, edx
jb 0x4a2f36
nop dword [eax + eax]
movzx ecx, word [eax + 0x1e8]
mov eax, dword [eax + 0xb0]
cmp cx, word [eax + 0x1ea]
jae 0x4a2f20
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov edi, dword [eax + edx + 0xcc]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0xdc]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x4c], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x44], xmm1
movsd qword [esp + 0x3c], xmm0
mov dword [eax + edx + 0xcc], edi
lea edi, [esp + 0xe0]
movsd xmm0, qword [esp + 0xd4]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0xc4]
movsd xmm1, qword [esp + 0xcc]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x58]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
movsd qword [eax + ecx], xmm0
movsd qword [eax + ecx + 8], xmm1
movsd xmm1, qword [esp + 0x44]
mov eax, dword [esp + 0x64]
movq xmm0, qword [esp + 0x3c]
movsd xmm2, qword [esp + 0x54]
movsd qword [esp + 0x154], xmm1
movsd xmm1, qword [esp + 0x4c]
mov dword [esp + 0x174], eax
movq qword [esp + 0x14c], xmm0
movsd qword [esp + 0x164], xmm2
movsd qword [esp + 0x15c], xmm1
movsd xmm1, qword [esp + 0x5c]
movsd qword [esp + 0x16c], xmm1
jmp 0x4a3217
mov ebx, dword [edi + 8]
test ebx, ebx
js 0x4a6721
mov esi, dword [edi + 4]
mov dword [esp + 0x18], edx
je 0x4a3080
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 1
push ebx
call fcn.0040cd10
add esp, 8
test eax, eax
jne 0x4a3085
jmp 0x4a6753
mov eax, 1
mov dword [esp + 0x10], ebx
push ebx
push esi
mov dword [esp + 0x1c], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [edi + 0x18]
xor eax, eax
lea ebx, [esi + esi]
test esi, esi
js 0x4a672a
cmp ebx, 0x7ffffffe
ja 0x4a672a
movzx eax, byte [edi + 0xc]
test ebx, ebx
mov dword [esp + 0x2c], 0
mov byte [esp + 0x28], al
mov eax, dword [edi + 0x14]
je 0x4a30f8
mov dword [esp + 0x1c], eax
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 2
push ebx
call fcn.0040cd10
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xf0], esi
test edi, edi
jne 0x4a3108
jmp 0x4a6725
mov edi, 2
mov dword [esp + 0xf0], 0
push ebx
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], eax
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x158], al
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x160], edi
mov dword [esp + 0x164], esi
mov edi, dword [eax + 8]
test edi, edi
js 0x4a6741
mov ebx, dword [eax + 4]
je 0x4a318a
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 1
push edi
call fcn.0040cd10
add esp, 8
mov esi, eax
test eax, eax
jne 0x4a318f
jmp 0x4a6739
mov esi, 1
push edi
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x18]
movzx eax, byte [eax + 0xc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
mov byte [esp + 0x48], al
lea edx, [esp + 0x104]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc4]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.00468d20
add esp, 8
mov eax, dword [esp + 0xc4]
test eax, 0x7fffffff
je 0x4a2dc0
jmp 0x4a2da0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], edx
lea edx, [esp + 0x3c]
lea eax, [esp + 0x114]
lea ecx, [esp + 0x14c]
push eax
call fcn.0046c250
add esp, 4
movsd xmm2, qword [esp + 0x164]
movsd xmm1, qword [esp + 0x15c]
mov eax, dword [esp + 0x174]
movq xmm0, qword [esp + 0x16c]
dec dword [esp + 0x10c]
cmp byte [esp + 0x114], 0
movsd qword [esp + 0x54], xmm2
movsd qword [esp + 0x4c], xmm1
movsd xmm2, qword [esp + 0x14c]
movsd xmm1, qword [esp + 0x154]
mov dword [esp + 0x64], eax
movq qword [esp + 0x5c], xmm0
movsd qword [esp + 0x44], xmm1
movsd qword [esp + 0x3c], xmm2
je 0x4a32b5
test esi, esi
je 0x4a6780
mov eax, dword [ebx + 0x1ec]
dec esi
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], esi
mov dword [eax + 0xb0], 0
push 4
push 0x21c
push ebx
call fcn.0040cd20
add esp, 0xc
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x18], edx
mov edx, eax
neg edx
jo 0x4a2dc0
jae 0x4a32e9
push 1
push eax
push ecx
call fcn.0040cd20
add esp, 0xc
test ebx, ebx
je 0x4a32fb
add ebx, ebx
push 2
push ebx
push edi
call fcn.0040cd20
add esp, 0xc
test esi, 0x7fffffff
je 0x4a2dc0
push 1
push esi
push dword [esp + 0x20]
jmp 0x4a2daa
mov eax, dword [esp + 0x10c]
movq xmm0, qword [esp + 0x104]
mov dword [esp + 0x13c], eax
mov eax, dword [0x59fb24]
movq qword [esp + 0x134], xmm0
mov dword [esp + 0x130], 1
movzx eax, byte [eax]
push 1
push 4
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x4a6799
mov edi, eax
mov dword [eax], 0x48544150
add eax, 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], eax
mov word [esp + 0x44], 0
lea ecx, [esp + 0xc4]
lea edx, [esp + 0x3c]
call fcn.00478e80
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0xcc]
movq xmm0, qword [esp + 0xc4]
mov dword [esp + 0x14c], 4
mov dword [esp + 0x150], edi
mov dword [esp + 0x154], 4
mov dword [esp + 0x158], 0
mov edx, dword [esp + 0x134]
mov dword [esp + 0x2c], 0
movq qword [esp + 0x15c], xmm0
mov dword [esp + 0x164], eax
mov dword [esp + 0x14], eax
test edx, edx
mov eax, dword [esp + 0x160]
mov dword [esp + 0x10], eax
je 0x4a34b8
mov eax, dword [esp + 0x138]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
movzx edi, word [edx + 0x1ea]
lea ecx, [edx + 0xb4]
mov ebx, 0xffffffff
mov dword [esp + 0xf0], edx
lea eax, [edi + edi*8]
mov dword [esp + 0x1c], edi
lea esi, [eax + eax*2]
add esi, edi
lea edi, [edx - 8]
nop dword [eax]
test esi, esi
je 0x4a3470
lea eax, [ecx + 0x1c]
mov dword [esp + 0x18], eax
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.kernel32.dll_CompareStringOrdinal
mov ecx, dword [esp + 0x18]
add esi, 0xffffffe4
add edi, 0x10
inc ebx
cmp eax, 3
je 0x4a3430
mov esi, dword [esp + 0xc]
cmp eax, 1
jne 0x4a349c
jmp 0x4a3478
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
sub eax, 1
jb 0x4a39e0
mov edx, dword [esp + 0xf0]
mov dword [esp + 0x28], eax
mov edx, dword [edx + ebx*4 + 0x1ec]
jmp 0x4a3405
cmp eax, 2
jne 0x4a66b2
mov eax, dword [edi - 4]
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x24]
jmp 0x4a34b8
push 1
push 4
push edi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x4a34e1
add eax, eax
push 2
push eax
push dword [esp + 0x18]
call fcn.0040cd20
add esp, 0xc
lea eax, [esp + 0x134]
mov edi, dword [esi + 0x20]
test edi, edi
je 0x4a3544
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, 0x4ab2e0
cmp edi, 4
jb 0x4a3526
mov eax, dword [edx]
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x4ab2e0
adc ecx, 0xffffffff
mov ecx, 0x4ab300
cmove eax, ecx
movzx ebx, byte [edi + edx - 1]
mov dword [esp + 0xf0], edx
mov dword [esp + 0x1c], edi
push ebx
call eax
add esp, 4
test al, al
je 0x4a35df
mov byte [esp + 0x94], 2
mov dword [esp + 0x98], 0x587650
mov ebx, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x80]
mov dword [eax + 4], ecx
mov dword [eax], ebx
mov dword [eax + 8], 2
cmp dword [esp + 0x130], 0
je 0x4a3699
mov ecx, dword [esp + 0x134]
test ecx, ecx
je 0x4a3674
mov edx, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], ecx
mov ecx, 1
mov dword [esp + 0x168], edx
jmp 0x4a3678
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xf0]
lea eax, [ecx + edx]
cmp edx, 3
mov dword [esp + 0x24], eax
jbe 0x4a36b7
movzx eax, byte [eax - 4]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
xor eax, eax
cmp cl, 0x2e
mov ecx, 0
jne 0x4a36e2
mov edi, dword [esp + 0x24]
movzx ecx, byte [edi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x4a36e0
movzx ecx, byte [edi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x4a36e0
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x4a36e2
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x16c], eax
lea ecx, [esp + 0x14c]
call fcn.0045eaa0
cmp dword [esp + 0x128], 4
jb 0x4a36af
push dword [esp + 0x12c]
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edx
mov ebx, edx
nop dword [eax + eax]
test eax, eax
je 0x4a3843
movzx edx, byte [ecx]
cmp edx, 0x2f
je 0x4a3766
inc ecx
dec eax
cmp edx, 0x5c
jne 0x4a36c0
jmp 0x4a3766
xor ecx, ecx
mov ebx, dword [esp + 0x1c]
nop word cs:[eax + eax]
cmp ebx, eax
je 0x4a3843
mov edx, dword [esp + 0xf0]
movzx edx, byte [edx + eax]
cmp edx, 0x2f
je 0x4a370e
inc eax
cmp edx, 0x5c
jne 0x4a36f0
test cl, cl
je 0x4a3766
mov edx, dword [esp + 0xf0]
lea ecx, [esp + 0x14c]
push ebx
call fcn.004a9400
add esp, 4
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x154]
jno 0x4a39b3
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x90], 0x80000000
jmp 0x4a3aef
test ebx, ebx
js 0x4a6878
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 1
push ebx
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x4a67a1
mov esi, eax
push ebx
push dword [esp + 0xf4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], esi
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], 0
lea eax, [esp + 0x14c]
push 4
push str..exeprogram_not_found
push eax
call fcn.004aa990
add esp, 0xc
mov eax, dword [esp + 0x14c]
mov edi, dword [esp + 0x150]
mov ebx, dword [esp + 0x154]
mov dword [esp + 0x18], eax
mov edx, edi
lea ecx, [esp + 0x3c]
push ebx
call fcn.004a70e0
add esp, 4
mov esi, dword [esp + 0xc]
xor eax, eax
cmp eax, dword [esp + 0x3c]
jno 0x4a391c
mov dword [esp + 0x10], ebx
push ebx
push edi
call fcn.00492f20
add esp, 8
test eax, eax
je 0x4a39aa
mov ebx, edx
cmp edx, 2
jne 0x4a393b
cmp word [eax], 0x2e2e
jne 0x4a393b
mov edx, 2
xor ecx, ecx
jmp 0x4a3a18
mov eax, dword [esp + 0xf0]
xor edi, edi
jmp 0x4a385b
xor edi, edi
test cx, cx
je 0x4a3901
mov cx, 1
test di, di
jne 0x4a3850
cmp eax, dword [esp + 0x24]
je 0x4a397c
movzx ebx, byte [eax]
test bl, bl
js 0x4a387e
mov edx, ebx
mov ebx, dword [esp + 0x1c]
inc eax
jmp 0x4a38d1
movzx esi, byte [eax + 1]
mov edx, ebx
and edx, 0x1f
and esi, 0x3f
cmp bl, 0xdf
jbe 0x4a38c5
movzx edi, byte [eax + 2]
shl esi, 6
and edi, 0x3f
or edi, esi
cmp bl, 0xf0
jb 0x4a38da
movzx esi, byte [eax + 3]
and edx, 7
shl edi, 6
add eax, 4
shl edx, 0x12
and esi, 0x3f
or esi, edi
or edx, esi
mov ebx, dword [esp + 0x1c]
cmp edx, 0xffff
jbe 0x4a38d1
jmp 0x4a38ee
mov ebx, dword [esp + 0x1c]
shl edx, 6
add eax, 2
or edx, esi
xor edi, edi
mov ecx, edx
jmp 0x4a3852
shl edx, 0xc
add eax, 3
or edx, edi
mov ebx, dword [esp + 0x1c]
cmp edx, 0xffff
jbe 0x4a38d1
and edx, 0x3ff
or edx, 0xdc00
mov edi, edx
jmp 0x4a3852
mov dword [esp + 0x94], 2
mov dword [esp + 0x98], 0x587624
jmp 0x4a3557
mov eax, dword [esp + 0x44]
movq xmm0, qword [esp + 0x3c]
mov dword [esp + 0x98], eax
movq qword [esp + 0x90], xmm0
jmp 0x4a3adb
xor edx, edx
mov ecx, eax
mov dword [esp + 0x14], edi
nop word cs:[eax + eax]
nop dword [eax]
cmp ebx, edx
je 0x4a39e5
cmp byte [ecx + ebx - 1], 0x2e
lea edi, [ecx - 1]
mov esi, edx
lea edx, [edx + 1]
mov ecx, edi
jne 0x4a3950
mov ecx, ebx
sub ecx, edx
jne 0x4a3a0e
xor ecx, ecx
mov edx, ebx
jmp 0x4a3a14
cmp ebx, 7
ja 0x4a39ef
mov eax, dword [esp + 0xf0]
mov edx, dword [esp + 0x2c]
mov ecx, ebx
nop
cmp byte [eax], 0x2e
je 0x4a4318
inc eax
dec ecx
jne 0x4a3990
mov dword [esp + 0x34], 0
jmp 0x4a4320
mov ebx, dword [esp + 0x10]
jmp 0x4a3a6b
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
lea ecx, [esp + 0x90]
lea edx, [esp + 0x14c]
call fcn.0049bc00
jmp 0x4a3aef
jmp 0x4a34b2
mov ecx, eax
mov esi, ebx
mov edx, ebx
xor eax, eax
jmp 0x4a3a14
push ebx
push dword [esp + 0xf4]
push 0x2e
call fcn.004dfdc0
add esp, 0xc
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x2c]
jmp 0x4a4320
mov edx, ecx
lea ecx, [edi + ebx + 1]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x4a3a57
test eax, eax
cmove edx, esi
add ecx, edx
sub ecx, edi
je 0x4a3a5d
mov esi, dword [esp + 0xc]
cmp ebx, ecx
jbe 0x4a3a63
cmp byte [edi + ecx], 0xbf
jg 0x4a3a65
push 0x5865fc
push 0x37
push 0x5865c2
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
mov esi, dword [esp + 0xc]
jmp 0x4a3a6b
mov esi, dword [esp + 0xc]
jmp 0x4a3a69
jne 0x4a3a3e
cmp ebx, ecx
jb 0x4a3a6b
mov ebx, ecx
mov edx, edi
lea ecx, [esp + 0x14c]
push ebx
call fcn.004a9400
add esp, 4
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x154]
jno 0x4a3ab3
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x90], 0x80000000
jmp 0x4a3adb
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
lea ecx, [esp + 0x90]
lea edx, [esp + 0x14c]
call fcn.0049bc00
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4a3aef
push 1
push eax
push edi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x2c], eax
neg eax
jo 0x4a3565
cmp ecx, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ecx
jb 0x4a4f3a
mov edx, dword [esp + 0x18]
mov ecx, 0x5c005c
mov eax, 0x5c003f
xor ecx, dword [edx]
mov edx, dword [edx + 4]
xor edx, eax
or edx, ecx
je 0x4a3b50
mov edx, dword [esp + 0x18]
mov ecx, 0x3f005c
xor ecx, dword [edx]
xor eax, dword [edx + 4]
or eax, ecx
jne 0x4a4f3a
cmp dword [esp + 0x20], 4
je 0x4a3bf5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
cmp word [eax + ecx*2 - 0xa], 0x2e
jne 0x4a3bf5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
movzx eax, word [eax + ecx*2 - 8]
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x4a3bf5
mov edx, dword [esp + 0x38]
add edx, dword [ecx*4 + 0x4a6f44]
jmp edx
mov eax, esi
mov ebx, dword [esi + 0x2c]
mov esi, dword [esi + 0x30]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
movzx eax, byte [eax + 0x69]
mov byte [esp + 0x10], al
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x24]
mov word [eax], 0x22
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x44], 1
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], edi
mov word [esp + 0x154], 0
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
call fcn.00478d20
mov edi, dword [esp + 0x44]
cmp edi, dword [esp + 0x3c]
jne 0x4a3c7d
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov word [eax + edi*2], 0x22
inc edi
test esi, esi
mov dword [esp + 0x44], edi
je 0x4a3cf0
movzx eax, byte [esp + 0x10]
shl esi, 2
lea edi, [esi + esi*4]
mov dword [esp + 0x10], eax
nop
mov esi, dword [esp + 0x44]
cmp esi, dword [esp + 0x3c]
jne 0x4a3cb3
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov word [eax + esi*2], 0x20
inc esi
mov dword [esp + 0x44], esi
lea edx, [esp + 0x3c]
lea ecx, [esp + 0xc4]
push dword [esp + 0x10]
push ebx
call fcn.0049b780
add esp, 8
cmp byte [esp + 0xc4], 4
jne 0x4a4203
add ebx, 0x14
add edi, 0xffffffec
jne 0x4a3ca0
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov ecx, eax
neg ecx
jo 0x4a422a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xf0], ecx
mov dword [esp + 0x28], edx
cmp eax, esi
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], esi
jne 0x4a3d4d
lea ecx, [esp + 0x104]
call fcn.0046dfb0
mov ebx, dword [esp + 0x108]
mov word [ebx + esi*2], 0
inc esi
mov eax, 0x608
mov ecx, 0x400
mov dword [esp + 0x10c], esi
mov esi, dword [esp + 0xc]
cmp byte [esi + 0x68], 0
cmovne ecx, eax
or ecx, dword [esi + 0x58]
test byte [esp + 0x130], 1
mov dword [esp + 0x34], ecx
je 0x4a4238
mov eax, dword [esp + 0x8c]
mov edi, 2
mov ebx, 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 0
mov dword [esp + 0x10], 0
mov esi, dword [eax + 8]
movq xmm0, qword [eax]
test esi, esi
mov dword [esp + 0x98], esi
movq qword [esp + 0x90], xmm0
jne 0x4a3e04
mov bl, 1
lea ecx, [esp + 0xa0]
call fcn.0046dfb0
mov edi, dword [esp + 0xa4]
mov ebx, 1
mov word [edi], 0
mov dword [esp + 0xa8], 1
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
xor edx, edx
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], ecx
mov dword [esp + 0x15c], edx
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], ecx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
mov dword [esp + 0x16c], esi
call fcn.0046ad30
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], edi
mov dword [esp + 0x20], ebx
test eax, eax
je 0x4a5f6a
mov edx, dword [esp + 0x44]
lea ecx, [edx + edx*8]
lea ecx, [ecx + ecx*2]
add ecx, edx
mov edi, dword [eax + ecx + 0xb4]
mov esi, edi
neg esi
jo 0x4a5f6a
mov dword [esp + 0x148], edi
mov edi, dword [eax + ecx + 0xc4]
shl edx, 4
mov esi, dword [eax + edx]
mov ebx, dword [eax + edx + 4]
mov edx, dword [eax + edx + 8]
mov dword [esp + 0x84], edi
mov edi, dword [eax + ecx + 0xcc]
mov dword [esp + 0x24], edx
mov edx, dword [eax + ecx + 0xb8]
mov dword [esp + 0x14], ebx
mov ebx, dword [eax + ecx + 0xc8]
mov dword [esp + 0x30], esi
mov dword [esp + 0x144], edi
mov edi, dword [eax + ecx + 0xbc]
xor eax, eax
mov dword [esp + 0x88], ebx
mov dword [esp + 0x110], edx
add edi, edx
mov dword [esp + 0x8c], edi
jmp 0x4a3f1c
xor eax, eax
test bx, bx
je 0x4a42ad
mov bx, 1
test ax, ax
jne 0x4a3f11
cmp edx, edi
je 0x4a3faf
movzx eax, byte [edx]
test al, al
js 0x4a3f39
inc edx
mov esi, eax
jmp 0x4a3fa6
movzx ecx, byte [edx + 1]
mov esi, eax
and esi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x4a3f72
movzx edi, byte [edx + 2]
shl ecx, 6
and edi, 0x3f
or edi, ecx
cmp al, 0xf0
jb 0x4a3f7c
movzx eax, byte [edx + 3]
and esi, 7
shl edi, 6
add edx, 4
shl esi, 0x12
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x4a3f84
shl esi, 6
add edx, 2
or esi, ecx
jmp 0x4a3fa6
shl esi, 0xc
add edx, 3
or esi, edi
mov edi, dword [esp + 0x8c]
cmp esi, 0xffff
jbe 0x4a3fa6
and esi, 0x3ff
or esi, 0xdc00
mov eax, esi
jmp 0x4a3f13
xor eax, eax
mov ebx, esi
jmp 0x4a3f13
mov eax, dword [esp + 0x148]
test eax, eax
je 0x4a3fcc
push 1
push eax
push dword [esp + 0x118]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0xa0]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x144]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
sub eax, edi
cmp eax, esi
jae 0x4a4017
mov edx, edi
lea ecx, [esp + 0xa0]
push 2
push 2
push esi
call fcn.0046e310
add esp, 0xc
mov ecx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov esi, dword [esp + 0x144]
lea eax, [esi + esi]
mov dword [esp + 0x38], ecx
lea ecx, [ecx + edi*2]
push eax
push dword [esp + 0x8c]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x84]
add edi, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0xa8], edi
test eax, eax
je 0x4a405e
add eax, eax
push 2
push eax
push dword [esp + 0x90]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
cmp eax, dword [esp + 0xa0]
jne 0x4a4082
lea ecx, [esp + 0xa0]
call fcn.0046dfb0
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
and dword [esp + 0x110], 0xffffff00
xor edi, edi
mov word [ecx + eax*2], 0x3d
inc eax
mov ecx, ebx
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x24]
add eax, ebx
mov dword [esp + 0x10], eax
jmp 0x4a40ba
xor edi, edi
test dx, dx
je 0x4a57ef
mov dx, 1
test di, di
jne 0x4a40af
cmp ecx, eax
je 0x4a415c
movzx ebx, byte [ecx]
test bl, bl
js 0x4a40db
mov esi, ebx
mov ebx, dword [esp + 0x14]
inc ecx
jmp 0x4a4153
movzx eax, byte [ecx + 1]
mov esi, ebx
and esi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x4a4116
movzx edi, byte [ecx + 2]
shl eax, 6
and edi, 0x3f
or edi, eax
cmp bl, 0xf0
jb 0x4a4128
movzx eax, byte [ecx + 3]
and esi, 7
shl edi, 6
add ecx, 4
shl esi, 0x12
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x4a4130
shl esi, 6
mov ebx, dword [esp + 0x14]
add ecx, 2
or esi, eax
mov eax, dword [esp + 0x10]
jmp 0x4a4153
shl esi, 0xc
add ecx, 3
or esi, edi
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp esi, 0xffff
jbe 0x4a4153
and esi, 0x3ff
or esi, 0xdc00
mov edi, esi
jmp 0x4a40b1
xor edi, edi
mov edx, esi
jmp 0x4a40b1
mov eax, dword [esp + 0x30]
mov edi, ebx
shr edi, 8
neg eax
jo 0x4a66aa
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], eax
mov word [esp + 0xcc], 0
lea ecx, [esp + 0xa0]
lea edx, [esp + 0xc4]
call fcn.00478d20
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a41b0
push 1
push eax
push ebx
call fcn.0040cd20
add esp, 0xc
mov ebx, dword [esp + 0xa8]
mov dword [esp + 0x140], edi
cmp ebx, dword [esp + 0xa0]
jne 0x4a41d3
lea ecx, [esp + 0xa0]
call fcn.0046dfb0
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
mov word [edi + ebx*2], 0
inc ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xa8], ebx
jmp 0x4a3e6e
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0xc8]
test eax, eax
je 0x4a422a
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x80]
mov dword [eax], ebx
jmp 0x4a5204
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], 2
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x38], ebx
cmp eax, dword [esi + 0x34]
jno 0x4a478d
mov dword [esp + 0x20], 0
mov dword [esp + 0x8c], 2
mov dword [esp + 0x24], 0
pxor xmm0, xmm0
mov cl, 1
xor eax, eax
movdqu xmmword [esp + 0xa0], xmm0
lock cmpxchg byte [0x5c915c], cl
jne 0x4a5fe9
mov eax, dword [0x5c913c]
test eax, 0x7fffffff
je 0x4a6006
call fcn.00499c20
xor al, 1
jmp 0x4a6008
mov eax, dword [esp + 0x148]
test eax, eax
je 0x4a42ca
push 1
push eax
push dword [esp + 0x118]
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x4a42e2
push 1
push ecx
push eax
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
or dword [esp + 0x10], 2
mov dword [esp + 0x24], 0x587624
test ecx, ecx
je 0x4a5820
add ecx, ecx
push 2
push ecx
push eax
call fcn.0040cd20
add esp, 0xc
jmp 0x4a5820
mov dword [esp + 0x34], 1
test edx, edx
je 0x4a46df
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc4], edx
add eax, edx
mov dword [esp + 0xc8], eax
mov word [esp + 0xcc], 0
mov byte [esp + 0xd0], 1
lea eax, [esp + 0xc4]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.004a0fb0
add esp, 8
mov eax, dword [esp + 0x3c]
mov ecx, eax
neg ecx
jo 0x4a46df
movzx ecx, word [esp + 0xcc]
mov edx, dword [esp + 0xc8]
movzx ebx, byte [esp + 0xd0]
mov esi, dword [esp + 0xc4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jmp 0x4a43ce
mov dword [esp + 0x3c], 0x80000000
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a43c0
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x3c]
mov ecx, eax
neg ecx
jo 0x4a46df
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
test edx, edx
jne 0x4a460d
test eax, eax
mov byte [esp + 0x20], bl
mov dword [esp + 0x18], esi
je 0x4a43f6
push 1
push eax
push ecx
call fcn.0040cd20
add esp, 0xc
xor eax, eax
xor ebx, ebx
mov esi, dword [esp + 0x10]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0x2c], 2
jmp 0x4a442d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov word [ecx + eax*2], di
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0xa8], eax
mov edi, esi
test si, si
je 0x4a4460
nop
mov dword [esp + 0x10], 0
xor esi, esi
cmp di, 0x22
je 0x4a4540
jmp 0x4a4560
mov esi, dword [esp + 0x18]
cmp esi, dword [esp + 0x14]
je 0x4a45a0
movzx ecx, byte [esi]
test cl, cl
js 0x4a4490
inc esi
mov edi, ecx
mov dword [esp + 0x18], esi
xor esi, esi
cmp di, 0x22
je 0x4a4540
jmp 0x4a4560
mov eax, esi
movzx esi, byte [esi + 1]
mov edi, ecx
and edi, 0x1f
and esi, 0x3f
cmp cl, 0xdf
jbe 0x4a44e1
movzx edx, byte [eax + 2]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp cl, 0xf0
jb 0x4a44f7
movzx ecx, byte [eax + 3]
and edi, 7
shl edx, 6
add eax, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, edx
or edi, ecx
cmp edi, 0xffff
mov dword [esp + 0x18], eax
ja 0x4a450b
xor esi, esi
cmp di, 0x22
je 0x4a4540
jmp 0x4a4560
shl edi, 6
add eax, 2
or edi, esi
mov dword [esp + 0x18], eax
xor esi, esi
cmp di, 0x22
je 0x4a4540
jmp 0x4a4560
shl edi, 0xc
add eax, 3
or edi, edx
cmp edi, 0xffff
mov dword [esp + 0x18], eax
jbe 0x4a44d7
lea ecx, [edi + 0xff0000]
and edi, 0x3ff
shr ecx, 0xa
or edi, 0xdc00
or ecx, 0xd800
mov eax, edi
mov esi, edi
mov edi, ecx
mov dword [esp + 0x10], eax
cmp di, 0x22
jne 0x4a4560
nop word cs:[eax + eax]
xor bl, 1
mov edi, esi
test si, si
jne 0x4a4440
jmp 0x4a4460
movzx ecx, di
cmp ecx, 0x3b
jne 0x4a4571
test bl, 1
je 0x4a4605
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0xa0]
jne 0x4a4420
lea ecx, [esp + 0xa0]
call fcn.0046dfb0
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], eax
jmp 0x4a4420
xor ebx, ebx
mov edx, dword [esp + 0x28]
movzx ecx, byte [esp + 0x20]
test edx, edx
setne al
or cl, al
test cl, 1
je 0x4a4399
push edx
push dword [esp + 0xa8]
lea eax, [esp + 0x154]
push eax
call fcn.0048fe20
add esp, 0xc
movq xmm0, qword [esp + 0x14c]
movsd xmm1, qword [esp + 0x154]
movsd qword [esp + 0x44], xmm1
movq qword [esp + 0x3c], xmm0
mov eax, dword [esp + 0xa0]
test eax, eax
jne 0x4a43ac
jmp 0x4a43c0
mov esi, dword [esp + 0x18]
mov bl, 1
jmp 0x4a45a2
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x10]
mov byte [esp + 0xd0], bl
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], edx
mov word [esp + 0xcc], di
mov dword [esp + 0xc4], esi
mov dword [esp + 0x158], eax
push dword [esp + 0x1c]
push dword [esp + 0xf4]
lea eax, [esp + 0x154]
push eax
call fcn.00491c90
add esp, 0xc
cmp dword [esp + 0x34], 1
je 0x4a4680
push 3
push str.exe.NULexit_code:
lea eax, [esp + 0x154]
push eax
call fcn.00492880
add esp, 0xc
mov esi, dword [esp + 0x150]
mov edx, esi
lea ecx, [esp + 0x3c]
push dword [esp + 0x154]
call fcn.004a70e0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a46b3
push 1
push eax
push esi
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0xc]
mov eax, ecx
neg eax
jno 0x4a62e8
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004a0fb0
add esp, 8
jmp 0x4a4363
lea ecx, [esp + 0x3c]
call fcn.004a11e0
mov esi, dword [esp + 0x3c]
mov eax, esi
neg eax
jno 0x4a4738
cmp byte [esp + 0x40], 3
jne 0x4a490e
mov esi, dword [esp + 0x44]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x4a4712
push edi
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x4a4726
push dword [ebx + 8]
push eax
push edi
call fcn.0040cd20
add esp, 0xc
push 4
push 0xc
push esi
call fcn.0040cd20
add esp, 0xc
jmp 0x4a490e
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x18], eax
push ebx
push edi
call fcn.00492de0
add esp, 8
test eax, eax
je 0x4a4873
test edx, edx
je 0x4a4871
cmp ebx, edx
jbe 0x4a4867
cmp byte [edi + edx], 0xbf
jg 0x4a486d
push 0x5865fc
push 0x37
push 0x5865c2
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x24], eax
jmp 0x4a47af
xor ebx, ebx
test si, si
je 0x4a4841
mov si, 1
test bx, bx
jne 0x4a47a4
cmp edx, eax
je 0x4a586d
movzx ebx, byte [edx]
test bl, bl
js 0x4a47cc
inc edx
mov edi, ebx
jmp 0x4a4838
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x4a4807
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x4a4811
movzx ecx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, eax
or edi, ecx
jmp 0x4a4819
shl edi, 6
add edx, 2
or edi, ecx
jmp 0x4a4838
shl edi, 0xc
add edx, 3
or edi, eax
mov eax, dword [esp + 0x24]
cmp edi, 0xffff
jbe 0x4a4838
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x4a47a6
xor ebx, ebx
mov esi, edi
jmp 0x4a47a6
mov edi, dword [esp + 0x14]
mov esi, 0x587624
mov ecx, 2
mov eax, dword [esp + 0x80]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x4a65ca
jne 0x4a4774
cmp ebx, edx
jb 0x4a4873
mov ebx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], edi
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], eax
lea esi, [esp + 0x14c]
push dword [esp + 0x1c]
push dword [esp + 0xf4]
push esi
call fcn.00491c90
add esp, 0xc
cmp dword [esp + 0x34], 1
je 0x4a48c5
push 3
push str.exe.NULexit_code:
push esi
call fcn.00492880
add esp, 0xc
mov esi, dword [esp + 0x150]
mov edx, esi
lea ecx, [esp + 0xc4]
push dword [esp + 0x154]
call fcn.004a70e0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a48fb
push 1
push eax
push esi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
neg eax
jno 0x4a4d6d
mov esi, 0x200
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
cmp esi, 0x201
jb 0x4a4962
jmp 0x4a4980
mov ebx, dword [esp + 0x1c]
jbe 0x4a4a18
cmp esi, 0x201
jae 0x4a4980
mov dword [esp + 0x10], 0x200
lea edi, [esp + 0x14c]
mov ebx, esi
jmp 0x4a49c3
mov ebx, dword [esp + 0x18]
sub esi, ebx
je 0x4a49b0
mov edx, ebx
lea ecx, [esp + 0xa0]
push 2
push 2
push esi
call fcn.0046e310
add esp, 0xc
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
push 0
call sub.kernel32.dll_SetLastError
push ebx
push edi
call sub.kernel32.dll_GetSystemDirectoryW
mov esi, eax
test eax, eax
jne 0x4a49e4
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a4ade
cmp esi, ebx
jne 0x4a4950
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a67d1
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x4a4980
jmp 0x4a4962
mov eax, dword [esp + 0x10]
cmp esi, eax
ja 0x4a68a1
push esi
push edi
lea esi, [esp + 0x44]
push esi
call fcn.0048fe20
add esp, 0xc
push ebx
push dword [esp + 0xf4]
push esi
call fcn.00491c90
add esp, 0xc
cmp dword [esp + 0x34], 1
je 0x4a4a5b
push 3
push str.exe.NULexit_code:
push esi
call fcn.00492880
add esp, 0xc
mov esi, dword [esp + 0x40]
mov edx, esi
lea ecx, [esp + 0xc4]
push dword [esp + 0x44]
call fcn.004a70e0
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a4a88
push 1
push eax
push esi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0xc4]
mov ebx, dword [esp + 0xc8]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a4ac4
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
cmp dword [esp + 0x2c], 0x80000001
mov esi, dword [esp + 0xc]
jg 0x4a4f25
mov esi, dword [esp + 0x20]
je 0x4a4b06
jmp 0x4a4b41
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a4b04
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
xor ebx, ebx
cmp bl, 3
jne 0x4a4b41
mov eax, esi
mov esi, dword [esi]
mov edi, dword [eax + 4]
mov ebx, eax
mov eax, dword [edi]
test eax, eax
je 0x4a4b20
push esi
call eax
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4a4b34
push dword [edi + 8]
push eax
push esi
call fcn.0040cd20
add esp, 0xc
push 4
push 0xc
push ebx
call fcn.0040cd20
add esp, 0xc
mov esi, 0x200
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
cmp esi, 0x201
jb 0x4a4b9e
jmp 0x4a4bc0
jbe 0x4a4c58
cmp esi, 0x201
jae 0x4a4bc0
mov dword [esp + 0x10], 0x200
lea edi, [esp + 0x14c]
mov ebx, esi
jmp 0x4a4c03
mov ebx, dword [esp + 0x18]
sub esi, ebx
je 0x4a4bf0
mov edx, ebx
lea ecx, [esp + 0xa0]
push 2
push 2
push esi
call fcn.0046e310
add esp, 0xc
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
push 0
call sub.kernel32.dll_SetLastError
push ebx
push edi
call sub.kernel32.dll_GetWindowsDirectoryW
mov esi, eax
test eax, eax
jne 0x4a4c24
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a4d84
cmp esi, ebx
jne 0x4a4b90
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a67ea
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x4a4bc0
jmp 0x4a4b9e
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
cmp esi, eax
ja 0x4a68b2
push esi
push edi
lea esi, [esp + 0x44]
push esi
call fcn.0048fe20
add esp, 0xc
push ebx
push dword [esp + 0xf4]
push esi
call fcn.00491c90
add esp, 0xc
cmp dword [esp + 0x34], 1
je 0x4a4c9f
push 3
push str.exe.NULexit_code:
push esi
call fcn.00492880
add esp, 0xc
mov esi, dword [esp + 0x40]
mov edx, esi
lea ecx, [esp + 0xc4]
push dword [esp + 0x44]
call fcn.004a70e0
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a4ccc
push 1
push eax
push esi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0xc4]
movzx esi, byte [esp + 0xc8]
movzx edi, byte [esp + 0xcb]
movzx ebx, word [esp + 0xc9]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a4d19
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
cmp dword [esp + 0x2c], 0x80000001
jg 0x4a4f17
lea ebx, [esp + 0x3c]
jne 0x4a4dac
cmp esi, 3
jne 0x4a4dac
mov eax, dword [esp + 0x20]
mov edi, dword [eax + 4]
mov esi, dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x4a4d47
push esi
call eax
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4a4d5b
push dword [edi + 8]
push eax
push esi
call fcn.0040cd20
add esp, 0xc
push 4
push 0xc
push dword [esp + 0x28]
call fcn.0040cd20
add esp, 0xc
jmp 0x4a4dac
mov eax, dword [esp + 0xcc]
mov ebx, dword [esp + 0xc8]
mov dword [esp + 0x20], eax
jmp 0x4a4f21
call sub.kernel32.dll_GetLastError
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a4da8
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
lea ebx, [esp + 0x3c]
lea eax, [esp + 0xc4]
push 4
push 0x586554
push eax
call fcn.004834c0
add esp, 0xc
mov edi, dword [esp + 0xc4]
mov eax, edi
neg eax
jo 0x4a4eff
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0xcc]
lea esi, [esp + 0x14c]
add eax, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x40], eax
mov word [esp + 0x44], 0
mov byte [esp + 0x48], 1
push ebx
push esi
call fcn.004a0fb0
add esp, 8
jmp 0x4a4e19
push ebx
push esi
call fcn.004a0fb0
add esp, 8
mov eax, dword [esp + 0x14c]
mov ecx, eax
neg ecx
jo 0x4a4eec
mov edx, dword [esp + 0x154]
mov ecx, dword [esp + 0x150]
test edx, edx
jne 0x4a4e4e
test eax, eax
je 0x4a4e0f
push 1
push eax
push ecx
call fcn.0040cd20
add esp, 0xc
jmp 0x4a4e0f
mov ebx, dword [esp + 0x158]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], edx
mov dword [esp + 0x158], ebx
push dword [esp + 0x1c]
push dword [esp + 0xf4]
push esi
call fcn.00491c90
add esp, 0xc
cmp dword [esp + 0x34], 1
je 0x4a4e9c
push 3
push str.exe.NULexit_code:
push esi
call fcn.00492880
add esp, 0xc
mov ebx, dword [esp + 0x150]
mov edx, ebx
lea ecx, [esp + 0xa0]
push dword [esp + 0x154]
call fcn.004a70e0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a4ed2
push 1
push eax
push ebx
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0xa0]
mov eax, ecx
neg eax
jno 0x4a662c
lea ebx, [esp + 0x3c]
jmp 0x4a4e03
test edi, edi
je 0x4a4eff
push 1
push edi
push dword [esp + 0x20]
call fcn.0040cd20
add esp, 0xc
mov byte [esp + 0x94], 2
mov dword [esp + 0x98], 0x587674
jmp 0x4a3557
shl edi, 0x10
or ebx, edi
shl ebx, 8
or ebx, esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
cmp ecx, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ecx
jae 0x4a3b21
mov eax, 0x200
xor esi, esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
mov dword [esp + 0x28], 2
cmp eax, 0x201
jb 0x4a4f7d
jmp 0x4a4f90
jbe 0x4a502b
cmp eax, 0x201
jae 0x4a4f90
mov dword [esp + 0x14], 0x200
lea edi, [esp + 0x14c]
mov ebx, eax
jmp 0x4a4fc1
sub eax, esi
je 0x4a4fb3
mov edx, esi
lea ecx, [esp + 0x3c]
push 2
push 2
push eax
call fcn.0046e310
add esp, 0xc
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x28]
mov ebx, esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x14], esi
push 0
call sub.kernel32.dll_SetLastError
push 0
mov dword [esp + 0x14], edi
push edi
push ebx
push dword [esp + 0x24]
call sub.kernel32.dll_GetFullPathNameW
test eax, eax
jne 0x4a4ff8
mov dword [esp + 0x1c], esi
mov edi, eax
call sub.kernel32.dll_GetLastError
mov esi, dword [esp + 0x1c]
mov ecx, eax
mov eax, edi
test ecx, ecx
jne 0x4a51da
cmp eax, ebx
jne 0x4a4f70
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a6767
lea eax, [ebx + ebx]
test ebx, ebx
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, 0x201
jae 0x4a4f90
jmp 0x4a4f7d
mov ecx, dword [esp + 0x14]
cmp eax, ecx
ja 0x4a687f
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp eax, 4
jb 0x4a50b5
cmp word [ecx + eax*2 - 8], 0x2e
jne 0x4a50b5
movzx ecx, word [ecx + eax*2 - 6]
xor ebx, ebx
lea edx, [ecx - 0x42]
cmp edx, 0x21
ja 0x4a50b7
mov edi, dword [esp + 0x38]
add edi, dword [edx*4 + 0x4a6ebc]
jmp edi
xor ebx, ebx
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a50d0
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
test bl, bl
je 0x4a3bf5
lea eax, [esp + 0x40]
mov edi, 0x200
xor ebx, ebx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
mov dword [esp + 0x28], 2
mov dword [esp + 0xf0], eax
cmp edi, 0x201
jb 0x4a512e
jmp 0x4a5150
jbe 0x4a520c
cmp edi, 0x201
jae 0x4a5150
lea eax, [esp + 0x14c]
mov esi, edi
mov dword [esp + 0x14], 0x200
mov edi, eax
jmp 0x4a5181
sub edi, ebx
je 0x4a5173
mov edx, ebx
lea ecx, [esp + 0x3c]
push 2
push 2
push edi
call fcn.0046e310
add esp, 0xc
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x28]
mov esi, ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x14], ebx
push 0
call sub.kernel32.dll_SetLastError
push esi
mov dword [esp + 0x14], edi
push edi
call sub.kernel32.dll_GetSystemDirectoryW
mov edi, eax
test eax, eax
jne 0x4a51a6
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a525a
cmp edi, esi
jne 0x4a5120
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a67b8
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jae 0x4a5150
jmp 0x4a512e
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a51fa
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x80]
mov byte [eax], 0
mov dword [eax + 4], esi
jmp 0x4a5494
mov eax, dword [esp + 0x14]
cmp edi, eax
ja 0x4a6890
xor eax, eax
lea ebx, [edi + edi]
test edi, edi
js 0x4a524b
cmp ebx, 0x7ffffffe
ja 0x4a524b
test ebx, ebx
je 0x4a5281
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 2
push ebx
call fcn.0040cd10
add esp, 8
test eax, eax
mov esi, edi
jne 0x4a5288
mov eax, 2
push ebx
push eax
call fcn.004cf340
add esp, 8
jmp 0x4a68d2
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a527a
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
xor ecx, ecx
jmp 0x4a5488
mov eax, 2
xor esi, esi
push ebx
push dword [esp + 0x14]
mov ebx, eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a52b1
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
mov dword [esp + 0xc4], esi
lea eax, [esp + 0xc8]
mov dword [esp + 0xc8], ebx
mov edx, ebx
mov ecx, str.cmd.exestd_src_syspalwindows_stdio.rs
xor ebx, ebx
mov dword [esp + 0xcc], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0xf0], eax
jmp 0x4a52ff
mov dword [esp + 0x10], ecx
mov ecx, edx
mov edx, esi
mov word [edx + edi*2], bx
mov ebx, dword [esp + 0x10]
inc edi
mov dword [esp + 0xcc], edi
test ecx, ecx
je 0x4a5370
test bx, bx
je 0x4a5348
mov esi, edx
mov edx, ecx
xor ecx, ecx
cmp edi, dword [esp + 0xc4]
jne 0x4a52e7
mov eax, str.cmd.exestd_src_syspalwindows_stdio.rs
mov esi, ebx
mov ebx, edx
sub eax, edx
mov edx, 0xaaaaaaab
add eax, 0xa
mul edx
mov eax, edx
mov edx, dword [esp + 0x14]
shr eax, 1
cmp cx, 1
mov dword [esp + 0x10], ecx
mov ecx, ebx
mov ebx, esi
adc edx, 0xffffffff
sub eax, edx
inc eax
jmp 0x4a53a0
lea eax, [0x5876a8]
cmp ecx, eax
je 0x4a5370
movzx eax, byte [ecx]
test al, al
js 0x4a53cb
inc ecx
mov esi, edx
mov ebx, eax
mov edx, ecx
xor ecx, ecx
jmp 0x4a530e
cmp dword [esp + 0x14], 1
je 0x4a545d
mov dword [esp + 0x10], ebx
xor ebx, ebx
cmp edi, dword [esp + 0xc4]
mov ecx, 0
mov eax, 0
mov dword [esp + 0x14], 1
jne 0x4a52ef
mov esi, ebx
mov ebx, ecx
inc eax
mov edx, edi
lea ecx, [esp + 0xc4]
push 2
push 2
push eax
call fcn.0046e310
add esp, 0xc
mov edx, dword [esp + 0xc8]
mov ecx, ebx
mov ebx, esi
jmp 0x4a52ef
movzx esi, byte [ecx + 1]
mov ebx, eax
mov dword [esp + 0x10], edx
and ebx, 0x1f
and esi, 0x3f
cmp al, 0xdf
jbe 0x4a540a
mov edx, ecx
movzx ecx, byte [ecx + 2]
shl esi, 6
and ecx, 0x3f
or ecx, esi
cmp al, 0xf0
jb 0x4a541f
movzx eax, byte [edx + 3]
and ebx, 7
shl ecx, 6
add edx, 4
shl ebx, 0x12
and eax, 0x3f
or eax, ecx
or ebx, eax
jmp 0x4a5427
shl ebx, 6
add ecx, 2
or ebx, esi
mov esi, dword [esp + 0x10]
mov edx, ecx
xor ecx, ecx
jmp 0x4a530e
shl ebx, 0xc
add edx, 3
or ebx, ecx
mov esi, dword [esp + 0x10]
cmp ebx, 0xffff
jbe 0x4a5456
lea eax, [ebx + 0xff0000]
and ebx, 0x3ff
shr eax, 0xa
or ebx, 0xdc00
or eax, 0xd800
mov ecx, ebx
mov ebx, eax
jmp 0x4a530e
xor ecx, ecx
jmp 0x4a530e
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x28], eax
neg eax
mov dword [esp + 0xf0], ecx
jno 0x4a54c3
mov esi, dword [esp + 0xcc]
mov ecx, dword [esp + 0xf0]
mov eax, dword [esp + 0x80]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
mov bl, 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4a54b6
add eax, eax
push 2
push eax
push dword [esp + 0x20]
call fcn.0040cd20
add esp, 0xc
test bl, bl
jne 0x4a3578
jmp 0x4a3699
xor eax, eax
mov esi, 0x14
test al, al
jne 0x4a68c8
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov byte [esp + 0x34], al
mov eax, dword [0x59fb24]
mov dword [esp + 0x38], ecx
movzx eax, byte [eax]
push 2
push esi
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x4a68c3
mov ecx, 0xa
lea edx, [0x587079]
mov esi, 1
mov word [eax], 0x63
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14c], ecx
lea ecx, [esp + 0x150]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], 1
mov dword [esp + 0x24], ecx
xor ecx, ecx
jmp 0x4a555e
mov word [eax + esi*2], cx
inc esi
mov ecx, edi
mov dword [esp + 0x154], esi
test cx, cx
je 0x4a5580
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5550
jmp 0x4a5680
lea ecx, [0x587094]
cmp edx, ecx
je 0x4a56db
movzx ebx, byte [edx]
test bl, bl
js 0x4a55a8
inc edx
mov ecx, ebx
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5550
jmp 0x4a5680
movzx edi, byte [edx + 1]
mov ecx, ebx
and ecx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x4a5610
mov dword [esp + 0x10], esi
mov esi, ecx
mov ecx, edx
movzx edx, byte [edx + 2]
shl edi, 6
and edx, 0x3f
or edx, edi
cmp bl, 0xf0
jb 0x4a5628
movzx edi, byte [ecx + 3]
add ecx, 4
shl edx, 6
mov dword [esp + 0x14], ecx
mov ecx, esi
and ecx, 7
shl ecx, 0x12
and edi, 0x3f
or edi, edx
or ecx, edi
mov esi, dword [esp + 0x10]
cmp ecx, 0xffff
ja 0x4a5642
mov edx, dword [esp + 0x14]
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5550
jmp 0x4a5680
shl ecx, 6
add edx, 2
or ecx, edi
xor edi, edi
cmp esi, dword [esp + 0x14c]
je 0x4a5680
jmp 0x4a5550
add ecx, 3
mov dword [esp + 0x14], ecx
mov ecx, esi
shl ecx, 0xc
or ecx, edx
mov esi, dword [esp + 0x10]
cmp ecx, 0xffff
jbe 0x4a55fb
lea edx, [ecx + 0xff0000]
and ecx, 0x3ff
shr edx, 0xa
or ecx, 0xdc00
or edx, 0xd800
mov edi, ecx
mov ecx, edx
mov edx, dword [esp + 0x14]
cmp esi, dword [esp + 0x14c]
jne 0x4a5550
nop word cs:[eax + eax]
nop dword [eax]
mov eax, 0x587078
mov dword [esp + 0x14], ecx
mov ecx, 0xaaaaaaab
mov dword [esp + 0x10], esi
mov esi, edx
mov ebx, edi
sub eax, edx
add eax, 0x1e
mul ecx
mov eax, edx
shr eax, 1
cmp di, 1
sbb eax, 0
add eax, 2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14c]
mov edi, edx
push 2
push 2
push eax
call fcn.0046e310
add esp, 0xc
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x14]
mov edx, esi
mov esi, edi
mov edi, ebx
jmp 0x4a5550
movq xmm0, qword [esp + 0x14c]
mov esi, dword [esp + 0x154]
movq qword [esp + 0x3c], xmm0
mov dword [esp + 0x44], esi
cmp esi, dword [esp + 0x3c]
jne 0x4a5704
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [edi + esi*2], 0x22
inc esi
add eax, eax
mov dword [esp + 0x44], esi
cmp eax, ecx
je 0x4a57a2
cmp word [edx + ecx], 0x22
lea ecx, [ecx + 2]
jne 0x4a571f
xor edi, edi
mov esi, 0x5870fc
mov ebx, 2
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a5752
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040cd20
add esp, 0xc
mov eax, 0x80000000
and edi, 0xffffff00
movzx ebx, bl
mov ecx, eax
or ebx, edi
neg ecx
jno 0x4a57e4
mov eax, dword [esp + 0x80]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
mov eax, dword [esp + 0x28]
mov bl, 1
test eax, eax
je 0x4a549d
add eax, eax
push 2
push eax
push dword [esp + 0xf8]
call fcn.0040cd20
add esp, 0xc
jmp 0x4a549d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor edx, edx
mov ebx, ecx
sub ebx, 1
jb 0x4a58e5
mov ecx, eax
movzx eax, word [eax + ebx*2]
cmp ax, 0x5c
jne 0x4a58d7
mov esi, 0x5870fc
mov ebx, 2
xor edi, edi
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a5741
jmp 0x4a5752
mov cl, 1
mov dword [esp + 0x1c], ecx
jmp 0x4a3d21
mov eax, dword [esp + 0x30]
mov esi, 2
mov dword [esp + 0x24], 0x587624
test eax, eax
je 0x4a5810
push 1
push eax
push ebx
call fcn.0040cd20
add esp, 0xc
mov edi, dword [esp + 0x140]
shl edi, 8
or edi, esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ecx, [esp + 0x14c]
call fcn.0045eaa0
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4a584d
add eax, eax
push 2
push eax
push dword [esp + 0xac]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], 2
jmp 0x4a65df
mov esi, dword [esp + 0x8c]
mov ecx, eax
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], ecx
mov word [esp + 0x154], 0
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
call fcn.00478e80
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x14]
cmp esi, eax
jne 0x4a58bb
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x24], eax
neg eax
mov word [ecx + esi*2], 0
jno 0x4a5f56
inc esi
jmp 0x4a484f
xor edx, edx
test ax, ax
mov eax, ecx
cmove edx, ecx
mov ecx, dword [esp + 0x20]
test edx, edx
cmove ebx, ecx
mov ecx, dword [esp + 0x3c]
cmove edx, eax
mov dword [esp + 0x10], edx
mov eax, ecx
sub eax, esi
cmp eax, ebx
jae 0x4a5922
mov edx, esi
lea ecx, [esp + 0x3c]
push 2
push 2
push ebx
call fcn.0046e310
add esp, 0xc
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
jmp 0x4a5926
mov dword [esp + 0x14], ecx
lea eax, [ebx + ebx]
lea ecx, [edi + esi*2]
push eax
push dword [esp + 0x14]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add esi, ebx
cmp esi, dword [esp + 0x14]
mov dword [esp + 0x44], esi
jne 0x4a5953
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
mov word [edi + esi*2], 0x22
inc esi
mov dword [esp + 0x44], esi
test eax, eax
je 0x4a6662
mov ecx, dword [esp + 0x38]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
movzx ecx, byte [esp + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x88], ecx
mov esi, dword [esp + 0x44]
cmp esi, dword [esp + 0x3c]
jne 0x4a5997
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
lea ebx, [esi + 1]
mov dword [esp + 0x1c], esi
mov word [edi + esi*2], 0x20
mov dword [esp + 0x44], ebx
cmp dword [eax], 1
jne 0x4a59f4
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x14c]
push dword [esp + 0x88]
push eax
call fcn.0049b780
add esp, 8
cmp byte [esp + 0x14c], 4
jne 0x4a6689
mov eax, dword [esp + 0x38]
add eax, 0x14
cmp eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
jne 0x4a5984
jmp 0x4a665e
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x84], eax
add eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov eax, ecx
jmp 0x4a5a18
inc eax
cmp dl, cl
je 0x4a5f39
cmp eax, dword [esp + 0x14]
je 0x4a5a44
movzx ecx, byte [eax]
mov esi, 0xffffffff
nop word cs:[eax + eax]
movzx edx, byte [esi + 0x587109]
cmp dl, cl
je 0x4a5a0f
test esi, esi
lea esi, [esi + 1]
jne 0x4a5a30
jmp 0x4a5a0f
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x10], edi
jmp 0x4a5a5b
xor eax, eax
test dx, dx
je 0x4a5fce
xor edi, edi
mov dx, 1
test ax, ax
jne 0x4a5a50
cmp ecx, dword [esp + 0x14]
je 0x4a5afd
movzx eax, byte [ecx]
test al, al
js 0x4a5a7c
inc ecx
mov esi, eax
jmp 0x4a5af4
movzx edi, byte [ecx + 1]
mov esi, eax
and esi, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x4a5abf
mov dword [esp + 0x30], ecx
movzx ecx, byte [ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp al, 0xf0
mov edi, ecx
jb 0x4a5acb
mov ecx, dword [esp + 0x30]
and esi, 7
shl edi, 6
shl esi, 0x12
movzx eax, byte [ecx + 3]
add ecx, 4
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x4a5ad7
shl esi, 6
add ecx, 2
or esi, edi
xor edi, edi
jmp 0x4a5af4
mov ecx, dword [esp + 0x30]
shl esi, 0xc
or esi, edi
add ecx, 3
xor edi, edi
cmp esi, 0xffff
jbe 0x4a5af4
and esi, 0x3ff
or esi, 0xdc00
mov eax, esi
jmp 0x4a5a52
xor eax, eax
mov edx, esi
jmp 0x4a5a52
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a5bfa
mov edi, dword [esp + 0x24]
cmp byte [eax + edi - 1], 0x5c
sete al
or al, byte [esp + 0x34]
mov byte [esp + 0x30], al
jmp 0x4a5b2c
cmp edi, dword [esp + 0x14]
je 0x4a5bf3
movzx eax, byte [edi]
test al, al
js 0x4a5b38
inc edi
mov esi, eax
jmp 0x4a5b83
movzx edx, byte [edi + 1]
mov esi, eax
and esi, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x4a5b71
movzx ecx, byte [edi + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp al, 0xf0
jb 0x4a5b7b
movzx eax, byte [edi + 3]
and esi, 7
shl ecx, 6
add edi, 4
shl esi, 0x12
and eax, 0x3f
or eax, ecx
or esi, eax
jmp 0x4a5b83
shl esi, 6
add edi, 2
or esi, edx
jmp 0x4a5b83
shl esi, 0xc
add edi, 3
or esi, ecx
mov eax, esi
and eax, 0x1ff800
cmp eax, 0xd800
sete al
cmp esi, 0x110000
sete cl
or cl, al
jne 0x4a5b22
cmp esi, 0x80
jae 0x4a5bd1
lea eax, [esi - 0x30]
cmp eax, 0xa
jb 0x4a5bd1
mov eax, esi
and eax, 0x5f
add eax, 0xffffffbf
cmp eax, 0x19
jbe 0x4a5bd1
push 0xc
push 0x58706c
push esi
call fcn.004dfdc0
add esp, 0xc
cmp eax, 1
jne 0x4a5be2
push esi
call fcn.004f0f80
add esp, 4
test al, al
je 0x4a5b22
cmp edi, dword [esp + 0x14]
mov byte [esp + 0x30], 1
jne 0x4a5b2c
jmp 0x4a5bfa
test byte [esp + 0x30], 1
je 0x4a5c32
cmp ebx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x1c]
jne 0x4a5c15
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov word [eax + ebx*2 + 2], 0x22
add ebx, 2
mov al, 1
mov dword [esp + 0x44], ebx
mov dword [esp + 0x84], eax
jmp 0x4a5c3d
mov dword [esp + 0x84], 0
xor esi, esi
xor edi, edi
jmp 0x4a5c54
mov eax, dword [esp + 0x10]
mov word [eax + ebx*2], si
inc ebx
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x44], ebx
test si, si
je 0x4a5c66
mov dword [esp + 0x1c], 0
jmp 0x4a5d32
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x14]
je 0x4a5e7e
movzx eax, byte [ecx]
test al, al
js 0x4a5c8f
inc ecx
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
jmp 0x4a5d32
movzx edx, byte [ecx + 1]
mov esi, eax
and esi, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x4a5ce0
mov dword [esp + 0x30], esi
movzx esi, byte [ecx + 2]
shl edx, 6
mov dword [esp + 0x1c], esi
and dword [esp + 0x1c], 0x3f
add dword [esp + 0x1c], edx
cmp al, 0xf0
mov edx, dword [esp + 0x1c]
jb 0x4a5cf6
movzx eax, byte [ecx + 3]
mov esi, dword [esp + 0x30]
shl edx, 6
add ecx, 4
mov dword [esp + 0x24], ecx
and esi, 7
and eax, 0x3f
shl esi, 0x12
or eax, edx
or esi, eax
jmp 0x4a5d06
shl esi, 6
add ecx, 2
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], ecx
or esi, edx
jmp 0x4a5d32
mov esi, dword [esp + 0x30]
add ecx, 3
mov dword [esp + 0x24], ecx
shl esi, 0xc
or esi, edx
cmp esi, 0xffff
jbe 0x4a5c59
lea eax, [esi + 0xff0000]
and esi, 0x3ff
shr eax, 0xa
or esi, 0xdc00
mov dword [esp + 0x1c], esi
or eax, 0xd800
mov esi, eax
movzx eax, si
cmp eax, 0x24
jg 0x4a5d79
cmp eax, 0xd
je 0x4a5d8d
cmp eax, 0x22
jne 0x4a5e5c
mov eax, dword [esp + 0x3c]
mov ecx, eax
sub ecx, ebx
cmp ecx, edi
jae 0x4a5de1
mov edx, ebx
lea ecx, [esp + 0x3c]
push 2
push 2
push edi
call fcn.0046e310
add esp, 0xc
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
jmp 0x4a5de5
cmp eax, 0x25
je 0x4a5d8d
cmp eax, 0x5c
jne 0x4a5e5c
inc edi
jmp 0x4a5e5e
mov eax, dword [esp + 0x3c]
sub eax, ebx
cmp eax, 6
ja 0x4a5db6
mov edx, ebx
lea ecx, [esp + 0x3c]
push 2
push 2
push 7
call fcn.0046e310
add esp, 0xc
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
jmp 0x4a5dba
mov eax, dword [esp + 0x10]
mov word [eax + ebx*2 + 0xc], 0x2c
mov dword [eax + ebx*2 + 8], 0x7e003a
mov dword [eax + ebx*2 + 4], 0x640063
mov dword [eax + ebx*2], 0x250025
mov dword [esp + 0x10], eax
add ebx, 7
jmp 0x4a5e58
test edi, edi
je 0x4a5e34
xor eax, eax
cmp edi, 0x10
jae 0x4a5df2
mov ecx, dword [esp + 0x10]
jmp 0x4a5e24
mov ecx, dword [esp + 0x10]
movdqa xmm0, xmmword [0x583c30]
mov eax, edi
and eax, 0xfffffff0
mov edx, eax
lea ecx, [ecx + ebx*2 + 0x10]
add ebx, eax
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x4a5e0b
mov ecx, dword [esp + 0x10]
cmp edi, eax
je 0x4a5e30
sub edi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec edi
jne 0x4a5e26
mov eax, dword [esp + 0x3c]
cmp ebx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], ebx
jne 0x4a5e4d
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov word [eax + ebx*2], 0x22
inc ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], ebx
xor edi, edi
cmp ebx, dword [esp + 0x3c]
jne 0x4a5c43
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
jmp 0x4a5c43
cmp byte [esp + 0x84], 0
je 0x4a59de
mov eax, dword [esp + 0x3c]
mov ecx, eax
sub ecx, ebx
cmp ecx, edi
jae 0x4a5eb9
mov edx, ebx
lea ecx, [esp + 0x3c]
push 2
push 2
push edi
call fcn.0046e310
add esp, 0xc
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
jmp 0x4a5ebd
test edi, edi
je 0x4a5f0c
xor eax, eax
cmp edi, 0x10
jae 0x4a5eca
mov ecx, dword [esp + 0x10]
jmp 0x4a5efc
mov ecx, dword [esp + 0x10]
movdqa xmm0, xmmword [0x583c30]
mov eax, edi
and eax, 0xfffffff0
mov edx, eax
lea ecx, [ecx + ebx*2 + 0x10]
add ebx, eax
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x4a5ee3
mov ecx, dword [esp + 0x10]
cmp edi, eax
je 0x4a5f08
sub edi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec edi
jne 0x4a5efe
mov eax, dword [esp + 0x3c]
cmp ebx, eax
mov dword [esp + 0x44], ebx
jne 0x4a5f25
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov word [eax + ebx*2], 0x22
inc ebx
mov dword [esp + 0x44], ebx
jmp 0x4a59de
xor edi, edi
mov esi, 0x5870b8
mov ebx, 2
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a5741
jmp 0x4a5752
mov esi, dword [esp + 0xc]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x20], ecx
jmp 0x4a4272
xor ebx, ebx
lea ecx, [esp + 0x14c]
call fcn.0045eaa0
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x38]
cmp eax, dword [esp + 0xa0]
jne 0x4a5f9e
xor ebx, ebx
lea ecx, [esp + 0xa0]
call fcn.0046dfb0
mov ebx, dword [esp + 0xa4]
mov ecx, dword [esp + 0x20]
mov word [ebx + ecx*2], 0
mov edi, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov edx, edi
mov dword [esp + 0x10], eax
neg edx
jno 0x4a62df
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x4a584d
mov esi, 0x587624
mov ebx, 2
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a5741
jmp 0x4a5752
push 0x5c915c
call fcn.004ac160
add esp, 4
mov eax, dword [0x5c913c]
test eax, 0x7fffffff
jne 0x4a42a1
xor eax, eax
movzx edx, byte [0x5c915d]
movzx ecx, byte [ebp + 0xc]
xor ebx, ebx
mov dword [esp + 0x120], 0x5c915c
mov byte [esp + 0x124], al
lea eax, [esp + 0x128]
lea edi, [esi + 8]
mov dword [esp + 0xc4], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0x114], 2
test dl, dl
lea edx, [esp + 0x114]
setne bl
test cl, cl
mov ecx, esi
cmovne edx, eax
cmp dword [esi], 6
mov dword [esp + 0x11c], ebx
cmovne edx, esi
cmp dword [esi + 8], 6
lea esi, [esi + 0x10]
cmove edi, eax
cmp dword [ecx + 0x10], 6
cmove esi, eax
lea eax, [esp + 0xc4]
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff6
call fcn.004a71e0
add esp, 8
movzx eax, byte [esp + 0x14c]
cmp al, 4
jne 0x4a61b3
mov ebx, dword [esp + 0x150]
lea eax, [esp + 0xcc]
mov edx, edi
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff5
call fcn.004a71e0
add esp, 8
movzx eax, byte [esp + 0x14c]
mov edi, dword [esp + 0x14]
cmp al, 4
jne 0x4a61ed
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0xd4]
mov dword [esp + 0x88], ecx
mov edx, esi
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff4
call fcn.004a71e0
add esp, 8
movzx eax, byte [esp + 0x14c]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x34]
cmp al, 4
jne 0x4a6224
mov edi, dword [esp + 0x150]
pxor xmm0, xmm0
test ebx, ebx
mov dword [esp + 0x7c], 0
movdqu xmmword [esp + 0x6c], xmm0
movdqu xmmword [esp + 0x5c], xmm0
movdqu xmmword [esp + 0x4c], xmm0
movdqu xmmword [esp + 0x3c], xmm0
jne 0x4a625f
cmp dword [esp + 0x88], 0
jne 0x4a625f
mov eax, 1
test edi, edi
jne 0x4a625f
cmp byte [edx + 0x44], 1
mov dword [esp + 0x30], ebx
jne 0x4a628d
movzx ecx, word [edx + 0x46]
mov dword [esp + 0x68], eax
mov word [esp + 0x6c], cx
mov ebx, dword [edx + 0x64]
test ebx, ebx
jne 0x4a6298
mov dword [esp + 0x3c], 0x44
lea ecx, [esp + 0x3c]
jmp 0x4a633a
mov edx, dword [esp + 0x80]
movzx edi, word [esp + 0x14d]
movzx ecx, byte [esp + 0x14f]
mov esi, dword [esp + 0x150]
mov word [edx + 1], di
mov edi, dword [esp + 0x14]
mov byte [edx + 3], cl
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x4a6510
movzx ecx, byte [esp + 0x14f]
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x150]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x14d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
push ebx
jmp 0x4a650b
movzx ecx, byte [esp + 0x14f]
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x150]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x14d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, 2
mov dword [edx + 8], 2
jmp 0x4a64ed
mov eax, dword [esp + 0x88]
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], eax
mov eax, 0x101
mov dword [esp + 0x7c], edi
cmp byte [edx + 0x44], 1
mov dword [esp + 0x30], ebx
je 0x4a618a
mov ebx, dword [edx + 0x64]
test ebx, ebx
je 0x4a61a2
add edx, 0x5c
mov dword [esp + 0x3c], 0x48
lea ecx, [esp + 0x90]
call fcn.004a79a0
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
test byte [esp + 0x90], 1
je 0x4a62fd
mov eax, dword [esp + 0x80]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x4a64d8
mov esi, dword [esp + 0xc]
jmp 0x4a4244
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
jmp 0x4a4f25
or esi, 0x80000
mov dword [esp + 0xc], ecx
mov eax, edi
mov ecx, 0x11
lea edi, [esp + 0x14c]
mov dword [esp + 0x34], esi
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14c]
mov edi, eax
mov dword [esp + 0x84], edx
mov dword [esp + 0x190], edx
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xa0]
push eax
push ecx
push dword [esp + 0x28]
push dword [esp + 0x44]
push esi
push 1
push 0
push 0
push dword [esp + 0x128]
push dword [esp + 0x114]
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4a6495
mov eax, dword [esp + 0x80]
movsd xmm1, qword [esp + 0xcc]
movq xmm0, qword [esp + 0xd4]
movsd xmm2, qword [esp + 0xc4]
test ebx, ebx
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0xa0]
movq qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x4a63bf
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0xc]
call fcn.00460210
push edi
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x88]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x30]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0x114], 4
mov edi, dword [esp + 0x14]
jb 0x4a63f4
push dword [esp + 0x118]
call sub.kernel32.dll_CloseHandle
lea ecx, [esp + 0x11c]
call fcn.0045f010
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a641c
add eax, eax
push 2
push eax
push dword [esp + 0x94]
call fcn.0040cd20
add esp, 0xc
test edi, edi
je 0x4a6431
add edi, edi
push 2
push edi
push dword [esp + 0x18]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x104]
test eax, eax
je 0x4a6450
add eax, eax
push 2
push eax
push dword [esp + 0x110]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a646c
add eax, eax
push 2
push eax
push dword [esp + 0xf8]
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0x2c]
test ecx, ecx
setne al
test byte [esp + 0x1c], al
je 0x4a3699
add ecx, ecx
push 2
push ecx
push dword [esp + 0x20]
call fcn.0040cd20
add esp, 0xc
jmp 0x4a3699
call sub.kernel32.dll_GetLastError
movzx ecx, word [esp + 0x90]
mov edx, dword [esp + 0x80]
test ebx, ebx
mov word [edx + 1], cx
mov ch, byte [esp + 0x92]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x4a64d8
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0xc]
call fcn.00460210
push edi
call sub.kernel32.dll_CloseHandle
mov esi, dword [esp + 0x114]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x30]
push dword [esp + 0x88]
call sub.kernel32.dll_CloseHandle
push ebx
call sub.kernel32.dll_CloseHandle
cmp esi, 4
jb 0x4a6510
push dword [esp + 0x118]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xc4], 0
je 0x4a6526
push dword [esp + 0xc8]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xcc], 0
je 0x4a653c
push dword [esp + 0xd0]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xd4], 0
je 0x4a6552
push dword [esp + 0xd8]
call sub.kernel32.dll_CloseHandle
mov esi, dword [esp + 0x120]
movzx eax, byte [esp + 0x124]
test byte [esp + 0x11c], 1
je 0x4a6582
test al, al
jne 0x4a659f
mov eax, dword [0x5c913c]
test eax, 0x7fffffff
je 0x4a659f
call fcn.00499c20
jmp 0x4a6597
test al, al
jne 0x4a659f
mov eax, dword [0x5c913c]
test eax, 0x7fffffff
je 0x4a659f
call fcn.00499c20
test al, al
jne 0x4a659f
mov byte [esi + 1], 1
xor eax, eax
xchg byte [esi], al
cmp al, 2
jne 0x4a65ae
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a65ca
add eax, eax
push 2
push eax
push dword [esp + 0x94]
call fcn.0040cd20
add esp, 0xc
test edi, edi
je 0x4a65df
add edi, edi
push 2
push edi
push dword [esp + 0x18]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x104]
test eax, eax
je 0x4a65fe
add eax, eax
push 2
push eax
push dword [esp + 0x110]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a661a
add eax, eax
push 2
push eax
push dword [esp + 0xf8]
call fcn.0040cd20
add esp, 0xc
cmp byte [esp + 0x1c], 0
je 0x4a3699
xor ebx, ebx
jmp 0x4a549d
mov eax, dword [esp + 0xa8]
mov ebx, dword [esp + 0xa4]
test edi, edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
je 0x4a4f21
push 1
push edi
push dword [esp + 0x20]
call fcn.0040cd20
add esp, 0xc
jmp 0x4a4f21
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
cmp esi, eax
jne 0x4a6677
lea ecx, [esp + 0x3c]
call fcn.0046dfb0
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov word [edi + esi*2], 0x22
inc esi
mov ebx, edi
jmp 0x4a5757
mov edi, dword [esp + 0x14c]
mov esi, dword [esp + 0x150]
mov ebx, edi
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a5741
jmp 0x4a5752
movzx esi, bl
jmp 0x4a5817
call sub.kernel32.dll_GetLastError
mov byte [esp + 0xc4], 0
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc4]
mov dword [esp + 0x3c], 0x5875c8
mov dword [esp + 0x40], 1
mov dword [esp + 0x4c], 0
mov dword [esp + 0xa0], eax
lea eax, [esp + 0xa0]
mov dword [esp + 0xa4], 0x4879a0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 1
push 0x5875f4
lea eax, [esp + 0x40]
push eax
call fcn.004daa80
add esp, 8
jmp 0x4a68d2
xor eax, eax
jmp 0x4a6758
mov eax, 2
push ebx
push eax
call fcn.004cf340
add esp, 8
jmp 0x4a68d2
mov dword [esp + 0x2c], 1
push edi
push dword [esp + 0x30]
call fcn.004cf340
add esp, 8
jmp 0x4a68d2
mov eax, 1
push ebx
push eax
call fcn.004cf340
add esp, 8
jmp 0x4a68d2
push 0x587be0
push 0x28
push str.internal_error:_entered_unreachable_code_fCX
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
push 0x584424
push 0x21
push str.assertion_failed:_self.height___0
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
mov dword [esp + 0x1c], 4
mov eax, 1
push dword [esp + 0x1c]
push eax
call fcn.004cf340
add esp, 8
jmp 0x4a68d2
push 0x587be0
push 0x28
push str.internal_error:_entered_unreachable_code_fCX
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
push 0x587be0
push 0x28
push str.internal_error:_entered_unreachable_code_fCX
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
push 0x587be0
push 0x28
push str.internal_error:_entered_unreachable_code_fCX
call fcn.004dab10
add esp, 0xc
jmp 0x4a68d2
call sub.kernel32.dll_GetLastError
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], eax
lea esi, [esp + 0x3c]
lea eax, [esp + 0xc4]
mov dword [esp + str.failure_getting_env_string_from_OS:], 0x5874b0
mov dword [esp + 0x150], 1
mov dword [esp + 0x15c], 0
mov dword [esp + 0xc4], esi
mov dword [esp + 0x154], eax
mov dword [esp + 0xc8], 0x4879a0
mov dword [esp + 0x158], 1
lea eax, [esp + 0x14c]
push 0x5874b8
push eax
call fcn.004daa80
add esp, 8
jmp 0x4a68d2
xor eax, eax
jmp 0x4a67a6
push 0x587bd0
push ecx
push eax
call fcn.004e0750
add esp, 0xc
jmp 0x4a68d2
push 0x587bd0
push eax
push edi
call fcn.004e0750
add esp, 0xc
jmp 0x4a68d2
push 0x587bd0
push eax
push esi
call fcn.004e0750
add esp, 0xc
jmp 0x4a68d2
push 0x587bd0
push eax
push esi
call fcn.004e0750
add esp, 0xc
jmp 0x4a68d2
mov eax, 2
push esi
push eax
call fcn.004cf340
add esp, 8
ud2