Function at 0x4554e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xb
add esp, 0xfffff004
push eax
dec eax
jne 0x4554ed
mov eax, dword [ebp - 4]
add esp, 0xfffff9e8
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4ae85c
mov eax, 0x49e99c
call fcn.0048dd88
mov eax, dword [esi + 8]
test eax, eax
je 0x455575
push eax
call sub.KERNEL32.DLL_GlobalSize
mov edi, eax
push edi
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x455548
xor eax, eax
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
jmp 0x456b74
push ebx
call sub.KERNEL32.DLL_GlobalLock
push edi
push dword [esi + 8]
push eax
call fcn.0048d6f8
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, ebx
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
jmp 0x456b74
mov edx, 0x4bf198
mov eax, str.Rar_DRXXXXXX
call fcn.00467e64
test al, al
jne 0x45559c
xor eax, eax
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
jmp 0x456b74
lea ecx, [ebp - 0x9968]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x4bf198
call fcn.0048f2ec
pop ecx
call fcn.0044a498
mov dword [ebp - 0x955c], eax
mov word [ebp - 0x9548], 0x14
mov eax, dword [edi]
mov dword [ebp - 0x4aec], eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x4ae8], edx
mov cl, byte [edi + 8]
mov byte [ebp - 0x4ae4], cl
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x4ae0], eax
push esi
push edi
lea esi, [edi + 0x10]
lea edi, [ebp - 0x4adc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x410]
lea edi, [ebp - 0x46dc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x810]
lea edi, [ebp - 0x42dc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0xc10]
lea edi, [ebp - 0x3edc]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1410]
lea edi, [ebp - 0x36dc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1810]
lea edi, [ebp - 0x32dc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1c10]
lea edi, [ebp - 0x2edc]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x1c90]
mov byte [ebp - 0x2e5c], al
push esi
push edi
lea esi, [edi + 0x1c91]
lea edi, [ebp - 0x2e5b]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2094]
mov dword [ebp - 0x2a58], eax
mov dl, byte [edi + 0x2098]
mov byte [ebp - 0x2a54], dl
mov ecx, dword [edi + 0x209c]
mov dword [ebp - 0x2a50], ecx
mov eax, dword [edi + 0x20a0]
mov dword [ebp - 0x2a4c], eax
mov edx, dword [edi + 0x20a4]
mov dword [ebp - 0x2a48], edx
mov ecx, dword [edi + 0x20a8]
mov dword [ebp - 0x2a44], ecx
mov al, byte [edi + 0x20ac]
mov byte [ebp - 0x2a40], al
mov dl, byte [edi + 0x20ad]
mov byte [ebp - 0x2a3f], dl
mov cl, byte [edi + 0x20ae]
mov byte [ebp - 0x2a3e], cl
mov eax, dword [edi + 0x20b0]
mov dword [ebp - 0x2a3c], eax
mov edx, dword [edi + 0x20b4]
mov dword [ebp - 0x2a38], edx
mov cl, byte [edi + 0x20b8]
mov byte [ebp - 0x2a34], cl
mov al, byte [edi + 0x20b9]
mov byte [ebp - 0x2a33], al
mov dl, byte [edi + 0x20ba]
mov byte [ebp - 0x2a32], dl
mov cl, byte [edi + 0x20bb]
mov byte [ebp - 0x2a31], cl
mov al, byte [edi + 0x20bc]
mov byte [ebp - 0x2a30], al
mov dl, byte [edi + 0x20bd]
mov byte [ebp - 0x2a2f], dl
mov ecx, dword [edi + 0x20c0]
mov dword [ebp - 0x2a2c], ecx
mov eax, dword [edi + 0x20c4]
mov dword [ebp - 0x2a28], eax
mov edx, dword [edi + 0x20c8]
mov dword [ebp - 0x2a24], edx
mov edx, dword [edi + 0x20cc]
mov dword [ebp - 0x2a20], edx
mov ecx, dword [edi + 0x20d0]
mov dword [ebp - 0x2a1c], ecx
mov eax, dword [edi + 0x20d4]
mov dword [ebp - 0x2a18], eax
mov edx, dword [edi + 0x20d8]
mov dword [ebp - 0x2a14], edx
inc dword [ebp - 0x953c]
mov ecx, dword [edi + 0x20dc]
mov dword [ebp - 0x2a10], ecx
mov al, byte [edi + 0x20e0]
mov byte [ebp - 0x2a0c], al
mov dl, byte [edi + 0x20e1]
mov byte [ebp - 0x2a0b], dl
mov cl, byte [edi + 0x20e2]
mov byte [ebp - 0x2a0a], cl
mov eax, dword [edi + 0x20e4]
mov dword [ebp - 0x2a08], eax
mov edx, dword [edi + 0x20e8]
mov dword [ebp - 0x2a04], edx
mov cl, byte [edi + 0x20ec]
mov byte [ebp - 0x2a00], cl
mov al, byte [edi + 0x20ed]
mov byte [ebp - 0x29ff], al
mov edx, dword [edi + 0x20f0]
mov dword [ebp - 0x29fc], edx
mov ecx, dword [edi + 0x20f4]
mov dword [ebp - 0x29f8], ecx
mov al, byte [edi + 0x20f8]
mov byte [ebp - 0x29f4], al
mov dl, byte [edi + 0x20f9]
mov byte [ebp - 0x29f3], dl
mov cl, byte [edi + 0x20fa]
mov byte [ebp - 0x29f2], cl
mov al, byte [edi + 0x20fb]
mov byte [ebp - 0x29f1], al
mov dl, byte [edi + 0x20fc]
mov byte [ebp - 0x29f0], dl
mov cl, byte [edi + 0x20fd]
mov byte [ebp - 0x29ef], cl
mov al, byte [edi + 0x20fe]
mov byte [ebp - 0x29ee], al
push esi
push edi
lea esi, [edi + 0x20ff]
lea edi, [ebp - 0x29ed]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x214f]
mov byte [ebp - 0x299d], al
mov dl, byte [edi + 0x2150]
mov byte [ebp - 0x299c], dl
mov cl, byte [edi + 0x2151]
mov byte [ebp - 0x299b], cl
mov eax, dword [edi + 0x2154]
mov dword [ebp - 0x2998], eax
mov edx, dword [edi + 0x2158]
mov dword [ebp - 0x2994], edx
push esi
push edi
lea esi, [edi + 0x215c]
lea edi, [ebp - 0x2990]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2180]
mov dword [ebp - 0x296c], eax
mov eax, dword [edi + 0x2184]
mov dword [ebp - 0x2968], eax
push esi
push edi
lea esi, [edi + 0x2188]
lea edi, [ebp - 0x2964]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x21ac]
mov dword [ebp - 0x2940], eax
mov eax, dword [edi + 0x21b0]
mov dword [ebp - 0x293c], eax
mov dl, byte [edi + 0x21b4]
mov byte [ebp - 0x2938], dl
mov cl, byte [edi + 0x21b5]
mov byte [ebp - 0x2937], cl
mov al, byte [edi + 0x21b6]
mov byte [ebp - 0x2936], al
mov dl, byte [edi + 0x21b7]
mov byte [ebp - 0x2935], dl
push esi
push edi
lea esi, [edi + 0x21b8]
lea edi, [ebp - 0x2934]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2278]
lea edi, [ebp - 0x2874]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2678]
mov dword [ebp - 0x2474], eax
mov dl, byte [edi + 0x267c]
mov byte [ebp - 0x2470], dl
mov cl, byte [edi + 0x267d]
mov byte [ebp - 0x246f], cl
mov al, byte [edi + 0x267e]
mov byte [ebp - 0x246e], al
mov edx, dword [edi + 0x2680]
mov dword [ebp - 0x246c], edx
mov ecx, dword [edi + 0x2684]
mov dword [ebp - 0x2468], ecx
mov eax, dword [edi + 0x2688]
mov dword [ebp - 0x2464], eax
mov edx, dword [edi + 0x268c]
mov dword [ebp - 0x2460], edx
push esi
push edi
lea esi, [edi + 0x2690]
lea edi, [ebp - 0x245c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2a90]
mov dword [ebp - 0x205c], eax
mov dl, byte [edi + 0x2a94]
mov byte [ebp - 0x2058], dl
push esi
push edi
lea esi, [edi + 0x2a95]
lea edi, [ebp - 0x2057]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2e95]
lea edi, [ebp - 0x1c57]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x3295]
mov byte [ebp - 0x1857], al
mov dl, byte [edi + 0x3296]
mov byte [ebp - 0x1856], dl
mov cl, byte [edi + 0x3297]
mov byte [ebp - 0x1855], cl
mov eax, dword [edi + 0x3298]
mov dword [ebp - 0x1854], eax
mov dl, byte [edi + 0x329c]
mov byte [ebp - 0x1850], dl
mov cl, byte [edi + 0x329d]
mov byte [ebp - 0x184f], cl
mov eax, dword [edi + 0x32a0]
mov dword [ebp - 0x184c], eax
inc dword [ebp - 0x953c]
mov dl, byte [edi + 0x32a4]
mov byte [ebp - 0x1848], dl
mov cl, byte [edi + 0x32a5]
mov byte [ebp - 0x1847], cl
mov ecx, 0x104
mov al, byte [edi + 0x32a6]
mov byte [ebp - 0x1846], al
mov dl, byte [edi + 0x32a7]
mov byte [ebp - 0x1845], dl
push esi
push edi
lea esi, [edi + 0x32a8]
lea edi, [ebp - 0x1844]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x36b8]
lea edi, [ebp - 0x1434]
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x3ed8]
lea edi, [ebp - 0xc14]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x42d8]
lea edi, [ebp - 0x814]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x4ad8]
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [edi + 0x4adc]
mov dword [ebp - 0x10], edx
mov ecx, dword [edi + 0x4ae0]
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x4ae4]
mov dword [ebp - 8], eax
lea eax, [edi + 0x20d0]
mov edx, dword [edi + 0x4ae8]
mov dword [ebp - 4], edx
lea edx, [ebx + 0x20d0]
inc dword [ebp - 0x953c]
mov word [ebp - 0x9548], 8
call fcn.0040d744
lea ecx, [ebx + 0x215c]
mov dword [ebp - 0x9560], ecx
mov ecx, 9
mov eax, dword [ebp - 0x9560]
push esi
push edi
mov esi, eax
add edi, 0x215c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9560]
pop edi
pop esi
lea ecx, [ebx + 0x2188]
mov edx, dword [eax + 0x24]
mov dword [edi + 0x2180], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x2184], edx
mov dword [ebp - 0x9564], ecx
mov eax, dword [ebp - 0x9564]
push esi
push edi
mov esi, eax
add edi, 0x2188
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9564]
pop edi
pop esi
mov edx, dword [eax + 0x24]
mov dword [edi + 0x21ac], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x21b0], edx
mov ecx, dword [ebx]
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dl, byte [ebx + 8]
mov byte [edi + 8], dl
mov ecx, dword [ebx + 0xc]
mov dword [edi + 0xc], ecx
push esi
push edi
lea esi, [ebx + 0x10]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x410]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x810]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0xc10]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1410]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1810]
add edi, 0x1810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1c10]
add edi, 0x1c10
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x1c90]
mov ecx, 0x100
mov byte [edi + 0x1c90], al
push esi
push edi
lea esi, [ebx + 0x1c91]
add edi, 0x1c91
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x2094]
mov dword [edi + 0x2094], eax
mov dl, byte [ebx + 0x2098]
mov byte [edi + 0x2098], dl
mov ecx, dword [ebx + 0x209c]
mov dword [edi + 0x209c], ecx
mov eax, dword [ebx + 0x20a0]
mov dword [edi + 0x20a0], eax
mov edx, dword [ebx + 0x20a4]
mov dword [edi + 0x20a4], edx
mov ecx, dword [ebx + 0x20a8]
mov dword [edi + 0x20a8], ecx
mov al, byte [ebx + 0x20ac]
mov byte [edi + 0x20ac], al
mov dl, byte [ebx + 0x20ad]
mov byte [edi + 0x20ad], dl
mov cl, byte [ebx + 0x20ae]
mov byte [edi + 0x20ae], cl
mov eax, dword [ebx + 0x20b0]
mov dword [edi + 0x20b0], eax
mov edx, dword [ebx + 0x20b4]
mov dword [edi + 0x20b4], edx
mov cl, byte [ebx + 0x20b8]
mov byte [edi + 0x20b8], cl
mov al, byte [ebx + 0x20b9]
mov byte [edi + 0x20b9], al
mov dl, byte [ebx + 0x20ba]
mov byte [edi + 0x20ba], dl
mov cl, byte [ebx + 0x20bb]
mov byte [edi + 0x20bb], cl
mov al, byte [ebx + 0x20bc]
mov byte [edi + 0x20bc], al
mov dl, byte [ebx + 0x20bd]
mov byte [edi + 0x20bd], dl
mov ecx, dword [ebx + 0x20c0]
mov dword [edi + 0x20c0], ecx
mov eax, dword [ebx + 0x20c4]
mov dword [edi + 0x20c4], eax
mov edx, dword [ebx + 0x20c8]
mov dword [edi + 0x20c8], edx
mov edx, dword [ebx + 0x20cc]
mov dword [edi + 0x20cc], edx
mov ecx, dword [ebx + 0x20dc]
mov dword [edi + 0x20dc], ecx
mov al, byte [ebx + 0x20e0]
mov byte [edi + 0x20e0], al
mov dl, byte [ebx + 0x20e1]
mov byte [edi + 0x20e1], dl
mov cl, byte [ebx + 0x20e2]
mov byte [edi + 0x20e2], cl
mov eax, dword [ebx + 0x20e4]
mov dword [edi + 0x20e4], eax
mov edx, dword [ebx + 0x20e8]
mov dword [edi + 0x20e8], edx
mov cl, byte [ebx + 0x20ec]
mov byte [edi + 0x20ec], cl
mov al, byte [ebx + 0x20ed]
mov byte [edi + 0x20ed], al
mov edx, dword [ebx + 0x20f0]
mov dword [edi + 0x20f0], edx
mov ecx, dword [ebx + 0x20f4]
mov dword [edi + 0x20f4], ecx
mov al, byte [ebx + 0x20f8]
mov byte [edi + 0x20f8], al
mov dl, byte [ebx + 0x20f9]
mov byte [edi + 0x20f9], dl
mov cl, byte [ebx + 0x20fa]
mov byte [edi + 0x20fa], cl
mov al, byte [ebx + 0x20fb]
mov byte [edi + 0x20fb], al
mov dl, byte [ebx + 0x20fc]
mov byte [edi + 0x20fc], dl
mov cl, byte [ebx + 0x20fd]
mov byte [edi + 0x20fd], cl
mov ecx, 0x14
mov al, byte [ebx + 0x20fe]
mov byte [edi + 0x20fe], al
push esi
push edi
lea esi, [ebx + 0x20ff]
add edi, 0x20ff
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x214f]
mov byte [edi + 0x214f], al
mov dl, byte [ebx + 0x2150]
mov byte [edi + 0x2150], dl
mov cl, byte [ebx + 0x2151]
mov byte [edi + 0x2151], cl
mov eax, dword [ebx + 0x2154]
mov dword [edi + 0x2154], eax
mov edx, dword [ebx + 0x2158]
mov dword [edi + 0x2158], edx
mov cl, byte [ebx + 0x21b4]
mov byte [edi + 0x21b4], cl
mov al, byte [ebx + 0x21b5]
mov byte [edi + 0x21b5], al
mov dl, byte [ebx + 0x21b6]
mov byte [edi + 0x21b6], dl
mov cl, byte [ebx + 0x21b7]
mov byte [edi + 0x21b7], cl
push esi
push edi
lea esi, [ebx + 0x21b8]
add edi, 0x21b8
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2278]
add edi, 0x2278
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2678]
pop esi
mov dword [edi + 0x2678], eax
mov dl, byte [ebx + 0x267c]
mov byte [edi + 0x267c], dl
mov cl, byte [ebx + 0x267d]
mov byte [edi + 0x267d], cl
mov al, byte [ebx + 0x267e]
mov byte [edi + 0x267e], al
mov edx, dword [ebx + 0x2680]
mov dword [edi + 0x2680], edx
mov ecx, dword [ebx + 0x2684]
mov dword [edi + 0x2684], ecx
mov ecx, 0x100
mov eax, dword [ebx + 0x2688]
mov dword [edi + 0x2688], eax
mov edx, dword [ebx + 0x268c]
mov dword [edi + 0x268c], edx
push esi
push edi
lea esi, [ebx + 0x2690]
add edi, 0x2690
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x2a90]
mov dword [edi + 0x2a90], eax
mov dl, byte [ebx + 0x2a94]
mov byte [edi + 0x2a94], dl
push esi
push edi
lea esi, [ebx + 0x2a95]
add edi, 0x2a95
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2e95]
add edi, 0x2e95
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x3295]
mov byte [edi + 0x3295], al
mov dl, byte [ebx + 0x3296]
mov byte [edi + 0x3296], dl
mov cl, byte [ebx + 0x3297]
mov byte [edi + 0x3297], cl
mov eax, dword [ebx + 0x3298]
mov dword [edi + 0x3298], eax
mov dl, byte [ebx + 0x329c]
mov byte [edi + 0x329c], dl
mov cl, byte [ebx + 0x329d]
mov byte [edi + 0x329d], cl
mov eax, dword [ebx + 0x32a0]
mov dword [edi + 0x32a0], eax
mov dl, byte [ebx + 0x32a4]
mov byte [edi + 0x32a4], dl
mov cl, byte [ebx + 0x32a5]
mov byte [edi + 0x32a5], cl
mov ecx, 0x104
mov al, byte [ebx + 0x32a6]
mov byte [edi + 0x32a6], al
mov dl, byte [ebx + 0x32a7]
mov byte [edi + 0x32a7], dl
push esi
push edi
lea esi, [ebx + 0x32a8]
add edi, 0x32a8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x36b8]
add edi, 0x36b8
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x3ed8]
add edi, 0x3ed8
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x42d8]
add edi, 0x42d8
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x4ad8]
mov dword [edi + 0x4ad8], eax
mov edx, dword [ebx + 0x4adc]
mov dword [edi + 0x4adc], edx
mov ecx, dword [ebx + 0x4ae0]
mov dword [edi + 0x4ae0], ecx
xor ecx, ecx
mov eax, dword [ebx + 0x4ae4]
mov dword [edi + 0x4ae4], eax
mov eax, 0x4ba5d4
mov edx, dword [ebx + 0x4ae8]
mov dword [edi + 0x4ae8], edx
xor edx, edx
call fcn.004587a4
lea edx, [ebp - 0x2a1c]
lea eax, [edi + 0x20d0]
call fcn.0040d744
push esi
push edi
lea esi, [ebp - 0x2990]
add edi, 0x215c
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x296c]
mov dword [edi + 0x2180], eax
mov eax, dword [ebp - 0x2968]
mov dword [edi + 0x2184], eax
push esi
push edi
lea esi, [ebp - 0x2964]
add edi, 0x2188
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2940]
mov dword [edi + 0x21ac], eax
mov eax, dword [ebp - 0x293c]
mov dword [edi + 0x21b0], eax
mov edx, dword [ebp - 0x4aec]
mov dword [edi], edx
mov ecx, dword [ebp - 0x4ae8]
mov dword [edi + 4], ecx
mov al, byte [ebp - 0x4ae4]
mov byte [edi + 8], al
mov edx, dword [ebp - 0x4ae0]
mov dword [edi + 0xc], edx
push esi
push edi
lea esi, [ebp - 0x4adc]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x46dc]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x42dc]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x3edc]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x36dc]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x32dc]
add edi, 0x1810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2edc]
add edi, 0x1c10
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x2e5c]
mov byte [edi + 0x1c90], al
push esi
push edi
lea esi, [ebp - 0x2e5b]
add edi, 0x1c91
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2a58]
mov dword [edi + 0x2094], eax
mov dl, byte [ebp - 0x2a54]
mov byte [edi + 0x2098], dl
mov ecx, dword [ebp - 0x2a50]
mov dword [edi + 0x209c], ecx
mov eax, dword [ebp - 0x2a4c]
mov dword [edi + 0x20a0], eax
mov edx, dword [ebp - 0x2a48]
mov dword [edi + 0x20a4], edx
mov ecx, dword [ebp - 0x2a44]
mov dword [edi + 0x20a8], ecx
mov al, byte [ebp - 0x2a40]
mov byte [edi + 0x20ac], al
mov dl, byte [ebp - 0x2a3f]
mov byte [edi + 0x20ad], dl
mov cl, byte [ebp - 0x2a3e]
mov byte [edi + 0x20ae], cl
mov eax, dword [ebp - 0x2a3c]
mov dword [edi + 0x20b0], eax
mov edx, dword [ebp - 0x2a38]
mov dword [edi + 0x20b4], edx
mov cl, byte [ebp - 0x2a34]
mov byte [edi + 0x20b8], cl
mov al, byte [ebp - 0x2a33]
mov byte [edi + 0x20b9], al
mov dl, byte [ebp - 0x2a32]
mov byte [edi + 0x20ba], dl
mov cl, byte [ebp - 0x2a31]
mov byte [edi + 0x20bb], cl
mov al, byte [ebp - 0x2a30]
mov byte [edi + 0x20bc], al
mov dl, byte [ebp - 0x2a2f]
mov byte [edi + 0x20bd], dl
mov ecx, dword [ebp - 0x2a2c]
mov dword [edi + 0x20c0], ecx
mov eax, dword [ebp - 0x2a28]
mov dword [edi + 0x20c4], eax
mov edx, dword [ebp - 0x2a24]
mov dword [edi + 0x20c8], edx
mov edx, dword [ebp - 0x2a20]
mov dword [edi + 0x20cc], edx
mov ecx, dword [ebp - 0x2a10]
mov dword [edi + 0x20dc], ecx
mov al, byte [ebp - 0x2a0c]
mov byte [edi + 0x20e0], al
mov dl, byte [ebp - 0x2a0b]
mov byte [edi + 0x20e1], dl
mov cl, byte [ebp - 0x2a0a]
mov byte [edi + 0x20e2], cl
mov eax, dword [ebp - 0x2a08]
mov dword [edi + 0x20e4], eax
mov edx, dword [ebp - 0x2a04]
mov dword [edi + 0x20e8], edx
mov cl, byte [ebp - 0x2a00]
mov byte [edi + 0x20ec], cl
mov al, byte [ebp - 0x29ff]
mov byte [edi + 0x20ed], al
mov edx, dword [ebp - 0x29fc]
mov dword [edi + 0x20f0], edx
mov ecx, dword [ebp - 0x29f8]
mov dword [edi + 0x20f4], ecx
mov al, byte [ebp - 0x29f4]
mov byte [edi + 0x20f8], al
mov dl, byte [ebp - 0x29f3]
mov byte [edi + 0x20f9], dl
mov cl, byte [ebp - 0x29f2]
mov byte [edi + 0x20fa], cl
mov al, byte [ebp - 0x29f1]
mov byte [edi + 0x20fb], al
mov dl, byte [ebp - 0x29f0]
mov byte [edi + 0x20fc], dl
mov cl, byte [ebp - 0x29ef]
mov byte [edi + 0x20fd], cl
mov al, byte [ebp - 0x29ee]
mov byte [edi + 0x20fe], al
push esi
push edi
lea esi, [ebp - 0x29ed]
add edi, 0x20ff
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x299d]
mov byte [edi + 0x214f], al
mov dl, byte [ebp - 0x299c]
mov byte [edi + 0x2150], dl
mov cl, byte [ebp - 0x299b]
mov byte [edi + 0x2151], cl
mov eax, dword [ebp - 0x2998]
mov dword [edi + 0x2154], eax
mov edx, dword [ebp - 0x2994]
mov dword [edi + 0x2158], edx
mov cl, byte [ebp - 0x2938]
mov byte [edi + 0x21b4], cl
mov al, byte [ebp - 0x2937]
mov byte [edi + 0x21b5], al
mov dl, byte [ebp - 0x2936]
mov byte [edi + 0x21b6], dl
mov cl, byte [ebp - 0x2935]
mov byte [edi + 0x21b7], cl
push esi
push edi
lea esi, [ebp - 0x2934]
add edi, 0x21b8
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2874]
add edi, 0x2278
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2474]
mov dword [edi + 0x2678], eax
mov dl, byte [ebp - 0x2470]
mov byte [edi + 0x267c], dl
mov cl, byte [ebp - 0x246f]
mov byte [edi + 0x267d], cl
mov al, byte [ebp - 0x246e]
mov byte [edi + 0x267e], al
mov edx, dword [ebp - 0x246c]
mov dword [edi + 0x2680], edx
mov ecx, dword [ebp - 0x2468]
mov dword [edi + 0x2684], ecx
mov eax, dword [ebp - 0x2464]
mov dword [edi + 0x2688], eax
mov edx, dword [ebp - 0x2460]
mov dword [edi + 0x268c], edx
push esi
push edi
lea esi, [ebp - 0x245c]
add edi, 0x2690
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x205c]
mov dword [edi + 0x2a90], eax
mov dl, byte [ebp - 0x2058]
mov byte [edi + 0x2a94], dl
push esi
push edi
lea esi, [ebp - 0x2057]
add edi, 0x2a95
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1c57]
add edi, 0x2e95
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x1857]
mov byte [edi + 0x3295], al
mov dl, byte [ebp - 0x1856]
mov byte [edi + 0x3296], dl
mov cl, byte [ebp - 0x1855]
mov byte [edi + 0x3297], cl
mov eax, dword [ebp - 0x1854]
mov dword [edi + 0x3298], eax
mov dl, byte [ebp - 0x1850]
mov byte [edi + 0x329c], dl
mov cl, byte [ebp - 0x184f]
mov byte [edi + 0x329d], cl
mov eax, dword [ebp - 0x184c]
mov dword [edi + 0x32a0], eax
mov dl, byte [ebp - 0x1848]
mov byte [edi + 0x32a4], dl
mov cl, byte [ebp - 0x1847]
mov byte [edi + 0x32a5], cl
mov al, byte [ebp - 0x1846]
mov byte [edi + 0x32a6], al
mov dl, byte [ebp - 0x1845]
mov byte [edi + 0x32a7], dl
push esi
push edi
lea esi, [ebp - 0x1844]
add edi, 0x32a8
mov ecx, 0x104
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1434]
add edi, 0x36b8
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0xc14]
add edi, 0x3ed8
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x814]
add edi, 0x42d8
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x4ad8], eax
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x4adc], edx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x4ae0], ecx
mov eax, dword [ebp - 8]
mov dword [edi + 0x4ae4], eax
mov edx, dword [ebp - 4]
mov dword [edi + 0x4ae8], edx
push 0x4aec
push 0
lea ecx, [ebp - 0x4aec]
push ecx
call fcn.0048d768
add esp, 0xc
call fcn.0044a498
cmp eax, dword [ebp - 0x955c]
jne 0x456714
cmp dword [0x4bc228], 0
je 0x456718
xor eax, eax
jmp 0x45671d
mov eax, 1
test al, al
jne 0x456728
mov byte [0x4bf196], 0
lea edx, [ebp - 0x9d68]
mov eax, 0x4ba5d4
xor ecx, ecx
call fcn.0045d244
cmp byte [ebp - 0x9d68], 0
je 0x456761
lea edx, [ebp - 0x9d68]
lea eax, [ebp - 0x9d68]
call fcn.0040b688
lea edx, [ebp - 0x9d68]
push edx
call fcn.0048f2ec
pop ecx
mov word [ebp - 0x9548], 0x20
lea eax, [ebp - 0x4be4]
call fcn.0040ee0c
add dword [ebp - 0x953c], 4
mov word [ebp - 0x9548], 8
mov word [ebp - 0x9548], 0x2c
mov word [ebp - 0x9548], 0x38
lea eax, [ebp - 0x4cdc]
call fcn.0040ee0c
add dword [ebp - 0x953c], 4
mov word [ebp - 0x9548], 0x44
mov edx, 0x49e7d1
lea eax, [ebp - 0x4cdc]
call fcn.0040efd4
lea eax, [ebp - 0xa208]
call fcn.00412dfc
lea eax, [ebp - 0xa1dc]
call fcn.00412dfc
lea eax, [ebp - 0xa1b0]
call fcn.00412dfc
mov word [ebp - 0x9548], 0x50
push 0
push 3
lea edx, [ebp - 0x4cdc]
lea eax, [ebp - 0x7108]
xor ecx, ecx
call fcn.00412334
inc dword [ebp - 0x953c]
mov word [ebp - 0x9548], 0x44
xor ebx, ebx
jmp 0x45684c
lea edx, [ebp - 0xb21c]
lea eax, [ebp - 0xae1c]
call fcn.0040a568
lea edx, [ebp - 0xb21c]
lea eax, [ebp - 0x4be4]
call fcn.0040efd4
lea ecx, [ebp - 0xb21c]
push ecx
call fcn.0048d918
pop ecx
add eax, ebx
add eax, 3
mov ebx, eax
lea edx, [ebp - 0xae1c]
lea eax, [ebp - 0x7108]
call fcn.00412468
test eax, eax
je 0x456816
test ebx, ebx
jne 0x4568d6
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7108]
dec dword [ebp - 0x953c]
call fcn.0041240c
sub dword [ebp - 0x953c], 4
lea eax, [ebp - 0x4cdc]
mov edx, 2
call fcn.0040ef28
sub dword [ebp - 0x953c], 4
lea eax, [ebp - 0x4be4]
mov edx, 2
call fcn.0040ef28
sub dword [ebp - 0x953c], 3
lea eax, [ebp - 0x4aec]
mov edx, 2
call fcn.00422970
pop eax
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
jmp 0x456b74
add ebx, 0x15
push ebx
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x9568], eax
cmp dword [ebp - 0x9568], 0
jne 0x456964
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7108]
dec dword [ebp - 0x953c]
call fcn.0041240c
sub dword [ebp - 0x953c], 4
lea eax, [ebp - 0x4cdc]
mov edx, 2
call fcn.0040ef28
sub dword [ebp - 0x953c], 4
lea eax, [ebp - 0x4be4]
mov edx, 2
call fcn.0040ef28
sub dword [ebp - 0x953c], 3
lea eax, [ebp - 0x4aec]
mov edx, 2
call fcn.00422970
pop eax
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
jmp 0x456b74
lea eax, [ebp - 0x4cdc]
call fcn.0040f19c
mov word [ebp - 0x9548], 0x5c
push 0
push 1
lea edx, [ebp - 0x4cdc]
lea eax, [ebp - 0x9534]
mov ecx, 1
call fcn.00412334
inc dword [ebp - 0x953c]
mov word [ebp - 0x9548], 0x44
jmp 0x4569b5
test byte [ebp - 0xa214], 5
je 0x4569b5
mov byte [esi + 0x4ef9], 0
jmp 0x4569ca
lea edx, [ebp - 0xae1c]
lea eax, [ebp - 0x9534]
call fcn.00412468
test eax, eax
je 0x4569a3
dec dword [ebp - 0x953c]
lea eax, [ebp - 0x9534]
mov edx, 2
call fcn.0041240c
dec dword [ebp - 0x953c]
lea eax, [ebp - 0x7108]
mov edx, 2
call fcn.0041240c
sub dword [ebp - 0x953c], 4
lea eax, [ebp - 0x4cdc]
mov edx, 2
call fcn.0040ef28
mov word [ebp - 0x9548], 0x2c
mov word [ebp - 0x9548], 8
jmp 0x456a7d
push dword [ebp - 0x9568]
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
mov word [ebp - 0x9548], 8
mov dword [edi], 0x14
xor eax, eax
mov dword [edi + 0x10], eax
mov ebx, 0x14
jmp 0x456ac7
lea eax, [ebp - 0xb61c]
push eax
lea edx, [ebx + edi]
push edx
call sub.KERNEL32.DLL_lstrcpyA
lea ecx, [ebp - 0xb61c]
push ecx
call fcn.0048d918
pop ecx
add eax, ebx
inc eax
mov ebx, eax
lea edx, [ebp - 0xb61c]
lea eax, [ebp - 0x4be4]
mov ecx, 0x400
call fcn.0040f058
test al, al
jne 0x456aa5
mov byte [edi + ebx], 0
lea eax, [ebp - 0x9968]
push eax
call fcn.0048f2ec
pop ecx
push dword [ebp - 0x9568]
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov word [ebp - 0x9548], 8
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x456b26
push ebx
push edi
push dword [esi + 8]
call fcn.0048d6f8
add esp, 0xc
push dword [ebp - 0x9568]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 0x9568]
mov edx, 2
push eax
lea eax, [ebp - 0x4be4]
sub dword [ebp - 0x953c], 4
call fcn.0040ef28
sub dword [ebp - 0x953c], 3
lea eax, [ebp - 0x4aec]
mov edx, 2
call fcn.00422970
pop eax
mov edx, dword [ebp - 0x9558]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret