Function at 0x4a3810
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x550
call 0x4a3824
pop eax
mov dword [esp + 0x38], ecx
mov ecx, dword [edx + 0x50]
mov esi, edx
mov dword [esp + 8], edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x128], eax
movzx eax, byte [edx + 0x54]
test al, al
jne 0x4a3870
test ecx, ecx
jne 0x4a3870
mov dword [esp + 0x130], 0
xor ebx, ebx
lea eax, [esp + 0x134]
mov ecx, dword [esi + 0x20]
test ecx, ecx
jne 0x4a41ad
jmp 0x4a4200
test al, al
mov dword [esp + 0xd8], 0
mov dword [esp + 0x34], ecx
mov dword [esp + 0xe0], 0
jne 0x4a3a0e
call sub.kernel32.dll_GetEnvironmentStringsW
test eax, eax
je 0x4a71e9
lea edi, [esp + 0x9c]
lea ebx, [esp + 0xe4]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
nop dword [eax + eax]
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.004a1810
add esp, 8
mov eax, dword [esp + 0x14c]
cmp eax, 0x80000000
je 0x4a3a02
mov ecx, dword [esp + 0x15c]
movq xmm0, qword [esp + 0x154]
mov esi, ebx
mov ebx, dword [esp + 0x150]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x160]
movd eax, xmm0
mov dword [esp + 0xe4], ebx
movdqa xmmword [esp + 0xc0], xmm0
add eax, ebx
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x164]
mov word [esp + 0xec], 0
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x168]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edx, esi
call fcn.0047b080
mov eax, dword [esp + 0x18]
movaps xmm0, xmmword [esp + 0xc0]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x40], ebx
movlps qword [esp + 0x44], xmm0
movq xmm0, qword [esp + 0x9c]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x10]
movq qword [ecx], xmm0
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xec], eax
lea edx, [esp + 0xd8]
mov ecx, edi
push esi
lea eax, [esp + 0x40]
push eax
call fcn.0046b080
add esp, 8
mov eax, dword [esp + 0x9c]
mov ebx, esi
mov esi, dword [esp + 8]
test eax, 0x7fffffff
je 0x4a38c0
push 1
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a38c0
push dword [esp + 0x8c]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov esi, dword [esp + 0x34]
xor edx, edx
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0x9c], edx
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], esi
nop dword [eax]
lea ecx, [esp + 0x9c]
call fcn.0045f6b0
mov edi, eax
test eax, eax
je 0x4a3fd2
cmp dword [edx], 0x80000000
mov ebx, edx
jne 0x4a3c00
mov ebx, dword [esp + 0xd8]
test ebx, ebx
je 0x4a3a70
mov esi, dword [esp + 0xdc]
mov edx, ebx
lea ecx, [esp + 0x8c]
push dword [edi + 0x18]
push dword [edi + 0x14]
push esi
call fcn.0046f3a0
add esp, 0xc
cmp dword [esp + 0x8c], 0
jne 0x4a3a70
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x98]
mov byte [esp + 0x114], 0
test ecx, ecx
jne 0x4a3b27
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], edx
lea edx, [esp + 0x3c]
lea eax, [esp + 0x114]
lea ecx, [esp + 0x14c]
push eax
call fcn.0046e560
add esp, 4
jmp 0x4a3ed3
movzx edx, word [eax + 0x1ea]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
jne 0x4a3b20
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], 0
dec ecx
mov dword [esp + 0x124], ecx
lea edx, [esp + 0x11c]
lea eax, [esp + 0x114]
lea ecx, [esp + 0x14c]
push eax
call fcn.0046e560
add esp, 4
movsd xmm2, qword [esp + 0x164]
movsd xmm1, qword [esp + 0x15c]
mov eax, dword [esp + 0x174]
movq xmm0, qword [esp + 0x16c]
mov edx, dword [esp + 0x178]
mov ecx, dword [esp + 0x180]
movsd qword [esp + 0xfc], xmm2
movsd qword [esp + 0xf4], xmm1
movsd xmm2, qword [esp + 0x14c]
movsd xmm1, qword [esp + 0x154]
mov dword [esp + 0x10c], eax
movq qword [esp + 0x104], xmm0
movsd qword [esp + 0xec], xmm1
movsd qword [esp + 0xe4], xmm2
movzx eax, word [edx + 0x1ea]
cmp ecx, eax
jae 0x4a3d96
mov eax, edx
jmp 0x4a3dc3
mov ecx, dword [edi + 8]
mov esi, dword [edi + 4]
test ecx, ecx
mov dword [esp + 0x18], ecx
je 0x4a3c35
js 0x4a710a
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 1
push ecx
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a7103
mov ecx, dword [esp + 0x18]
jmp 0x4a3c3a
mov eax, 1
push ecx
push esi
mov dword [esp + 0x14], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [edi + 0x18]
movzx eax, byte [edi + 0xc]
mov ecx, dword [edi + 0x14]
test esi, esi
mov byte [esp + 0x10], al
je 0x4a3c9f
mov dword [esp + 0xc0], ecx
lea ecx, [esi + esi]
cmp esi, 0x3fffffff
mov dword [esp + 0x14], ecx
ja 0x4a7125
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 2
push ecx
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a711e
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc0]
jmp 0x4a3ca6
mov edi, 2
xor eax, eax
push eax
push ecx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], eax
movzx eax, byte [esp + 0x10]
mov byte [esp + 0x158], al
mov dword [esp + 0x15c], esi
mov dword [esp + 0x160], edi
mov dword [esp + 0x164], esi
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
test edi, edi
je 0x4a3d26
mov dword [esp + 0x18], eax
js 0x4a70ff
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 1
push edi
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a7139
mov esi, eax
mov eax, dword [esp + 0x18]
jmp 0x4a3d2b
mov esi, 1
push edi
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
mov byte [esp + 0x48], al
lea edx, [esp + 0xd8]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xe4]
push eax
lea eax, [esp + 0x150]
push eax
call fcn.0046b080
add esp, 8
mov eax, dword [esp + 0xe4]
test eax, 0x7fffffff
je 0x4a3a70
push 1
push eax
push dword [esp + 0xf0]
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a3a70
mov edi, dword [esp + 0x17c]
nop dword [eax]
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x4a3dbf
movzx ecx, word [edx + 0x1e8]
inc edi
mov edx, eax
cmp cx, word [eax + 0x1ea]
jae 0x4a3da0
jmp 0x4a3dc3
xor eax, eax
mov ecx, edi
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov edi, dword [eax + edx + 0xcc]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0xfc]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x4c], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x44], xmm1
movsd qword [esp + 0x3c], xmm0
mov dword [eax + edx + 0xcc], edi
lea edi, [esp + 0x100]
movsd xmm0, qword [esp + 0xf4]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0xe4]
movsd xmm1, qword [esp + 0xec]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x58]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
movsd qword [eax + ecx], xmm0
movsd qword [eax + ecx + 8], xmm1
movsd xmm1, qword [esp + 0x44]
mov eax, dword [esp + 0x64]
movq xmm0, qword [esp + 0x3c]
movsd xmm2, qword [esp + 0x54]
movsd qword [esp + 0x154], xmm1
movsd xmm1, qword [esp + 0x4c]
mov dword [esp + 0x174], eax
movq qword [esp + 0x14c], xmm0
movsd qword [esp + 0x164], xmm2
movsd qword [esp + 0x15c], xmm1
movsd xmm1, qword [esp + 0x5c]
movsd qword [esp + 0x16c], xmm1
movsd xmm2, qword [esp + 0x164]
movsd xmm1, qword [esp + 0x15c]
mov eax, dword [esp + 0x174]
movq xmm0, qword [esp + 0x16c]
dec dword [esp + 0xe0]
cmp byte [esp + 0x114], 0
movsd qword [esp + 0x54], xmm2
movsd qword [esp + 0x4c], xmm1
movsd xmm2, qword [esp + 0x14c]
movsd xmm1, qword [esp + 0x154]
mov dword [esp + 0x64], eax
movq qword [esp + 0x5c], xmm0
movsd qword [esp + 0x44], xmm1
movsd qword [esp + 0x3c], xmm2
je 0x4a3f71
test esi, esi
je 0x4a7166
mov eax, dword [ebx + 0x1ec]
dec esi
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], esi
mov dword [eax + 0xb0], 0
push 4
push 0x21c
push ebx
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
cmp eax, 0x80000000
mov dword [esp + 0x18], edx
je 0x4a3a70
test eax, eax
je 0x4a3fa8
push 1
push eax
push ecx
call fcn.0040d1e0
add esp, 0xc
test ebx, ebx
je 0x4a3fba
add ebx, ebx
push 2
push ebx
push edi
call fcn.0040d1e0
add esp, 0xc
test esi, 0x7fffffff
je 0x4a3a70
push 1
push esi
push dword [esp + 0x20]
jmp 0x4a3d89
mov eax, dword [esp + 0xe0]
movq xmm0, qword [esp + 0xd8]
mov dword [esp + 0x13c], eax
mov eax, dword [0x55bd94]
movq qword [esp + 0x134], xmm0
mov dword [esp + 0x130], 1
movzx eax, byte [eax]
push 1
push 4
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a7198
mov edi, eax
mov dword [eax], 0x48544150
add eax, 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], eax
mov word [esp + 0x44], 0
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x3c]
call fcn.0047b080
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xec]
movq xmm0, qword [esp + 0xe4]
mov dword [esp + 0x14c], 4
mov dword [esp + 0x150], edi
mov dword [esp + 0x154], 4
mov dword [esp + 0x158], 0
mov edx, dword [esp + 0x134]
xor ebx, ebx
mov dword [esp + 0x34], edi
movq qword [esp + 0x15c], xmm0
mov dword [esp + 0x164], eax
mov dword [esp + 0x10], eax
test edx, edx
mov eax, dword [esp + 0x160]
mov dword [esp + 0xc], eax
je 0x4a4173
mov eax, dword [esp + 0x138]
mov dword [esp + 0xc0], eax
movzx edi, word [edx + 0x1ea]
lea ecx, [edx + 0xb4]
mov ebx, 0xffffffff
mov dword [esp + 0x14], edx
lea eax, [edi + edi*8]
mov dword [esp + 0x20], edi
lea esi, [eax + eax*2]
add esi, edi
lea edi, [edx - 8]
nop word cs:[eax + eax]
test esi, esi
je 0x4a4130
lea eax, [ecx + 0x1c]
mov dword [esp + 0x18], eax
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call sub.kernel32.dll_CompareStringOrdinal
mov ecx, dword [esp + 0x18]
add esi, 0xffffffe4
add edi, 0x10
inc ebx
cmp eax, 3
je 0x4a40f0
mov esi, dword [esp + 8]
cmp eax, 1
jne 0x4a415f
jmp 0x4a4138
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc0]
mov edx, dword [esp + 0x14]
sub eax, 1
jb 0x4a4690
mov edx, dword [edx + ebx*4 + 0x1ec]
mov dword [esp + 0xc0], eax
jmp 0x4a40c1
cmp eax, 2
jne 0x4a7090
mov ebx, dword [edi - 4]
mov eax, dword [edi]
mov dword [esp + 0x10], eax
jmp 0x4a4173
push 1
push 4
push dword [esp + 0x3c]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x4a419f
add eax, eax
push 2
push eax
push dword [esp + 0x14]
call fcn.0040d1e0
add esp, 0xc
lea eax, [esp + 0x134]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4a4200
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x34], eax
mov eax, 0x4abc60
cmp ecx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ecx
jb 0x4a41e9
mov eax, dword [edi]
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x4abc60
adc ecx, 0xffffffff
mov ecx, 0x4abc80
cmove eax, ecx
mov ecx, dword [esp + 0x18]
movzx ebx, byte [ecx + edi - 1]
push ebx
call eax
add esp, 4
test al, al
je 0x4a4298
mov byte [esp + 0x90], 2
mov dword [esp + 0x94], 0x543300
mov ecx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x38]
mov dword [eax + 4], ebx
mov dword [eax], ecx
mov dword [eax + 8], 2
cmp dword [esp + 0x130], 0
je 0x4a434e
mov ecx, dword [esp + 0x134]
test ecx, ecx
je 0x4a4329
mov edx, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], ecx
mov dword [esp + 0x158], edx
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], ecx
mov ecx, 1
mov dword [esp + 0x168], edx
jmp 0x4a432d
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc0], edi
lea esi, [edi + eax]
cmp eax, 3
mov dword [esp + 0x20], esi
jbe 0x4a436c
movzx eax, byte [esi - 4]
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
xor eax, eax
cmp cl, 0x2e
mov ecx, 0
jne 0x4a43a0
movzx ecx, byte [esi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x4a4390
movzx ecx, byte [esi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x4a4394
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x4a43a0
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x15c], ecx
mov dword [esp + 0x16c], eax
lea ecx, [esp + 0x14c]
call fcn.00460fd0
cmp dword [esp + 0x128], 4
jb 0x4a4364
push dword [esp + 0x12c]
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
nop
test eax, eax
je 0x4a44ee
movzx edx, byte [ecx]
cmp edx, 0x2f
je 0x4a4411
inc ecx
dec eax
cmp edx, 0x5c
jne 0x4a4370
jmp 0x4a4411
xor ecx, ecx
jmp 0x4a43a0
xor ecx, ecx
nop word cs:[eax + eax]
cmp dword [esp + 0x18], eax
je 0x4a44ee
movzx edx, byte [edi + eax]
cmp edx, 0x2f
je 0x4a43b9
inc eax
cmp edx, 0x5c
jne 0x4a43a0
test cl, cl
je 0x4a4411
mov edx, edi
lea ecx, [esp + 0x14c]
push dword [esp + 0x18]
call fcn.004a9de0
add esp, 4
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
cmp edx, 0x80000000
jne 0x4a4663
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
mov dword [esp + 0x8c], 0x80000000
jmp 0x4a4799
mov ebx, dword [esp + 0x18]
test ebx, ebx
js 0x4a725e
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 1
push ebx
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a71a0
mov esi, eax
push ebx
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], esi
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], 0
lea eax, [esp + 0x14c]
push 4
push str..exeprogram_not_found
push eax
call fcn.004ab330
add esp, 0xc
mov esi, dword [esp + 0x14c]
mov edi, dword [esp + 0x150]
mov ebx, dword [esp + 0x154]
mov edx, edi
lea ecx, [esp + 0x3c]
push ebx
call fcn.004a7aa0
add esp, 4
cmp dword [esp + 0x3c], 0x80000000
jne 0x4a45c3
mov dword [esp + 0x18], ebx
push ebx
push edi
call fcn.00494240
add esp, 8
test eax, eax
je 0x4a465a
mov ebx, edx
cmp edx, 2
mov dword [esp + 0xc], esi
jne 0x4a45e2
movzx ecx, word [eax]
cmp ecx, 0x2e2e
jne 0x4a45e2
mov edx, 2
xor ecx, ecx
jmp 0x4a46c4
mov eax, edi
xor edi, edi
jmp 0x4a450b
xor edi, edi
test cx, cx
je 0x4a45a8
mov cx, 1
test di, di
jne 0x4a4500
cmp eax, esi
je 0x4a461c
movzx ebx, byte [eax]
test bl, bl
js 0x4a4528
inc eax
mov edx, ebx
jmp 0x4a457b
movzx esi, byte [eax + 1]
mov edx, ebx
and edx, 0x1f
and esi, 0x3f
cmp bl, 0xdf
jbe 0x4a456f
movzx edi, byte [eax + 2]
shl esi, 6
and edi, 0x3f
or edi, esi
cmp bl, 0xf0
jb 0x4a4581
movzx esi, byte [eax + 3]
and edx, 7
shl edi, 6
add eax, 4
shl edx, 0x12
and esi, 0x3f
or esi, edi
or edx, esi
mov esi, dword [esp + 0x20]
cmp edx, 0xffff
jbe 0x4a457b
jmp 0x4a4595
shl edx, 6
add eax, 2
or edx, esi
mov esi, dword [esp + 0x20]
xor edi, edi
mov ecx, edx
jmp 0x4a4502
shl edx, 0xc
add eax, 3
or edx, edi
mov esi, dword [esp + 0x20]
cmp edx, 0xffff
jbe 0x4a457b
and edx, 0x3ff
or edx, 0xdc00
mov edi, edx
jmp 0x4a4502
mov dword [esp + 0x90], 2
mov dword [esp + 0x94], 0x5432d4
jmp 0x4a4213
mov eax, dword [esp + 0x44]
movq xmm0, qword [esp + 0x3c]
mov dword [esp + 0x94], eax
movq qword [esp + 0x8c], xmm0
jmp 0x4a4789
xor edx, edx
mov ecx, eax
mov dword [esp + 0x10], edi
nop word [eax + eax]
cmp ebx, edx
je 0x4a4697
cmp byte [ecx + ebx - 1], 0x2e
lea edi, [ecx - 1]
mov esi, edx
lea edx, [edx + 1]
mov ecx, edi
jne 0x4a45f0
mov ecx, ebx
sub ecx, edx
jne 0x4a46ba
xor ecx, ecx
mov edx, ebx
jmp 0x4a46c0
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0xc0]
cmp ecx, 7
ja 0x4a46a1
mov edx, dword [esp + 0xc]
mov eax, ebx
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [eax], 0x2e
je 0x4a57fd
inc eax
dec ecx
jne 0x4a4640
mov dword [esp + 0x30], 0
jmp 0x4a5805
mov ebx, dword [esp + 0x18]
jmp 0x4a4717
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x14c]
call fcn.0049c9b0
jmp 0x4a4799
xor ebx, ebx
jmp 0x4a4173
mov ecx, eax
mov esi, ebx
mov edx, ebx
xor eax, eax
jmp 0x4a46c0
push ecx
push ebx
push 0x2e
call fcn.004e1300
add esp, 0xc
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0xc]
jmp 0x4a5805
mov edx, ecx
lea ecx, [edi + ebx + 1]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x4a4703
test eax, eax
cmove edx, esi
add ecx, edx
sub ecx, edi
je 0x4a4709
mov esi, dword [esp + 0xc]
cmp ebx, ecx
jbe 0x4a470f
cmp byte [edi + ecx], 0xbf
jg 0x4a4711
push 0x542254
push 0x37
push 0x54221a
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
mov esi, dword [esp + 0xc]
jmp 0x4a4717
mov esi, dword [esp + 0xc]
jmp 0x4a4715
jne 0x4a46ea
cmp ebx, ecx
jb 0x4a4717
mov ebx, ecx
mov edx, edi
lea ecx, [esp + 0x14c]
push ebx
call fcn.004a9de0
add esp, 4
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
cmp edx, 0x80000000
jne 0x4a4761
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
mov dword [esp + 0x8c], 0x80000000
jmp 0x4a4789
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], ecx
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x14c]
call fcn.0049c9b0
test esi, esi
je 0x4a4799
push 1
push esi
push edi
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
cmp edi, 0x80000000
je 0x4a4221
cmp ebx, 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
jb 0x4a47fe
mov edx, dword [esp + 0x18]
mov ecx, 0x5c005c
mov eax, 0x5c003f
xor ecx, dword [edx]
mov edx, dword [edx + 4]
xor edx, eax
or edx, ecx
je 0x4a49b9
mov edx, dword [esp + 0x18]
mov ecx, 0x3f005c
xor ecx, dword [edx]
xor eax, dword [edx + 4]
or eax, ecx
je 0x4a49b9
mov ebx, 0x200
xor edi, edi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
mov dword [esp + 0x14], 2
cmp ebx, 0x201
jb 0x4a483e
jmp 0x4a4860
jbe 0x4a48ec
cmp ebx, 0x201
jae 0x4a4860
lea eax, [esp + 0x14c]
mov esi, ebx
mov dword [esp + 0xc], 0x200
mov ebx, eax
jmp 0x4a488d
sub ebx, edi
je 0x4a487f
mov edx, edi
lea ecx, [esp + 0x3c]
push ebx
call fcn.0046f8c0
add esp, 4
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
mov esi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0xc], edi
push 0
call sub.kernel32.dll_SetLastError
push 0
mov dword [esp + 0x14], ebx
push ebx
push esi
push dword [esp + 0x24]
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test eax, eax
jne 0x4a48b8
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a49ce
cmp ebx, esi
jne 0x4a4830
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a714d
lea ebx, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x4a4860
jmp 0x4a483e
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 8]
cmp ebx, eax
ja 0x4a7265
mov edi, dword [esp + 0xc0]
cmp ebx, 4
jb 0x4a498f
mov eax, dword [esp + 0x10]
cmp word [eax + ebx*2 - 8], 0x2e
jne 0x4a498f
movzx eax, word [eax + ebx*2 - 6]
mov dword [esp + 0x28], 0
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x4a4997
mov edx, dword [esp + 0x2c]
add edx, dword [ecx*4 + 0x4a7874]
jmp edx
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a4a8c
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a4a8c
mov esi, dword [esp + 8]
cmp ebx, 4
jne 0x4a49fa
mov edi, dword [esp + 0xc0]
jmp 0x4a4a84
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a49ee
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x38]
mov byte [eax], 0
jmp 0x4a5733
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0xc0]
cmp word [eax + ebx*2 - 0xa], 0x2e
jne 0x4a4a84
movzx eax, word [eax + ebx*2 - 8]
mov dword [esp + 0x28], 0
lea ecx, [eax - 0x42]
cmp ecx, 0x21
ja 0x4a4a8c
mov edx, dword [esp + 0x2c]
add edx, dword [ecx*4 + 0x4a78fc]
jmp edx
mov dword [esp + 0x28], 0
cmp byte [esp + 0x28], 0
je 0x4a4b92
lea eax, [esp + 0x40]
mov edi, 0x200
xor ebx, ebx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0xc0], eax
cmp edi, 0x201
jb 0x4a4aee
jmp 0x4a4b10
jbe 0x4a4cbf
cmp edi, 0x201
jae 0x4a4b10
lea eax, [esp + 0x14c]
mov esi, edi
mov dword [esp + 0xc], 0x200
mov edi, eax
jmp 0x4a4b3d
sub edi, ebx
je 0x4a4b2f
mov edx, ebx
lea ecx, [esp + 0x3c]
push edi
call fcn.0046f8c0
add esp, 4
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
mov esi, ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0xc], ebx
push 0
call sub.kernel32.dll_SetLastError
push esi
mov dword [esp + 0x14], edi
push edi
call sub.kernel32.dll_GetSystemDirectoryW
mov edi, eax
test eax, eax
jne 0x4a4b62
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a4cff
cmp edi, esi
jne 0x4a4ae0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a717f
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jae 0x4a4b10
jmp 0x4a4aee
mov eax, esi
mov ebx, dword [esi + 0x2c]
mov esi, dword [esi + 0x30]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0
movzx eax, byte [eax + 0x69]
mov byte [esp + 0xc], al
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax], 0x22
mov dword [esp + 0x14c], edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x44], 1
mov dword [esp + 0x150], edi
mov word [esp + 0x154], 0
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
call fcn.0047af20
mov edi, dword [esp + 0x44]
cmp edi, dword [esp + 0x3c]
jne 0x4a4c13
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax + edi*2], 0x22
inc edi
test esi, esi
mov dword [esp + 0x44], edi
je 0x4a4c90
movzx eax, byte [esp + 0xc]
shl esi, 2
lea edi, [esi + esi*4]
mov dword [esp + 0xc], eax
nop word cs:[eax + eax]
nop
mov esi, dword [esp + 0x44]
cmp esi, dword [esp + 0x3c]
jne 0x4a4c53
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax + esi*2], 0x20
inc esi
mov dword [esp + 0x44], esi
lea edx, [esp + 0x3c]
lea ecx, [esp + 0xe4]
push dword [esp + 0xc]
push ebx
call fcn.0049c540
add esp, 8
cmp byte [esp + 0xe4], 4
jne 0x4a5706
add ebx, 0x14
add edi, 0xffffffec
jne 0x4a4c40
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
cmp eax, 0x80000000
mov dword [esp + 0xc0], ecx
mov dword [esp + 0x20], edx
je 0x4a572d
jmp 0x4a5233
mov eax, dword [esp + 0xc]
cmp edi, eax
ja 0x4a7276
test edi, edi
je 0x4a4d26
lea esi, [edi + edi]
cmp edi, 0x3fffffff
ja 0x4a7287
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 2
push esi
call fcn.0040d1d0
add esp, 8
test eax, eax
jne 0x4a4d2d
mov eax, 2
jmp 0x4a7289
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a4d1f
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
xor ecx, ecx
jmp 0x4a4f33
mov eax, 2
xor esi, esi
push esi
push dword [esp + 0x14]
mov esi, eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a4d56
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
lea eax, [esp + 0xe8]
mov edx, esi
mov ecx, str.cmd.exelibrary_std_src_syspalwindows_stdio.rsX3T
xor ebx, ebx
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc0], eax
jmp 0x4a4da8
mov dword [esp + 0xc], ecx
mov ecx, edx
mov edx, esi
mov word [edx + edi*2], bx
mov ebx, dword [esp + 0xc]
inc edi
mov dword [esp + 0xec], edi
test ecx, ecx
je 0x4a4e20
test bx, bx
je 0x4a4e00
mov esi, edx
mov edx, ecx
xor ecx, ecx
cmp edi, dword [esp + 0xe4]
jne 0x4a4d90
mov eax, str.cmd.exelibrary_std_src_syspalwindows_stdio.rsX3T
mov esi, ebx
mov ebx, edx
sub eax, edx
mov edx, 0xaaaaaaab
add eax, 0xa
mul edx
mov eax, edx
mov edx, dword [esp + 0x10]
shr eax, 1
cmp cx, 1
mov dword [esp + 0xc], ecx
mov ecx, ebx
mov ebx, esi
adc edx, 0xffffffff
sub eax, edx
inc eax
jmp 0x4a4e50
lea eax, [0x543358]
cmp ecx, eax
je 0x4a4e20
movzx eax, byte [ecx]
test al, al
js 0x4a4e77
inc ecx
mov esi, edx
mov ebx, eax
mov edx, ecx
xor ecx, ecx
jmp 0x4a4db7
cmp dword [esp + 0x10], 1
je 0x4a4f09
mov dword [esp + 0xc], ebx
xor ebx, ebx
cmp edi, dword [esp + 0xe4]
mov ecx, 0
mov eax, 0
mov dword [esp + 0x10], 1
jne 0x4a4d98
mov esi, ebx
mov ebx, ecx
inc eax
mov edx, edi
lea ecx, [esp + 0xe4]
push eax
call fcn.0046f8c0
add esp, 4
mov edx, dword [esp + 0xe8]
mov ecx, ebx
mov ebx, esi
jmp 0x4a4d98
movzx esi, byte [ecx + 1]
mov ebx, eax
mov dword [esp + 0xc], edx
and ebx, 0x1f
and esi, 0x3f
cmp al, 0xdf
jbe 0x4a4eb6
mov edx, ecx
movzx ecx, byte [ecx + 2]
shl esi, 6
and ecx, 0x3f
or ecx, esi
cmp al, 0xf0
jb 0x4a4ecb
movzx eax, byte [edx + 3]
and ebx, 7
shl ecx, 6
add edx, 4
shl ebx, 0x12
and eax, 0x3f
or eax, ecx
or ebx, eax
jmp 0x4a4ed3
shl ebx, 6
add ecx, 2
or ebx, esi
mov esi, dword [esp + 0xc]
mov edx, ecx
xor ecx, ecx
jmp 0x4a4db7
shl ebx, 0xc
add edx, 3
or ebx, ecx
mov esi, dword [esp + 0xc]
cmp ebx, 0xffff
jbe 0x4a4f02
lea eax, [ebx + 0xff0000]
and ebx, 0x3ff
shr eax, 0xa
or ebx, 0xdc00
or eax, 0xd800
mov ecx, ebx
mov ebx, eax
jmp 0x4a4db7
xor ecx, ecx
jmp 0x4a4db7
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe8]
cmp eax, 0x80000000
mov dword [esp + 0xc0], ecx
jne 0x4a4f4a
mov esi, dword [esp + 0xec]
mov ecx, dword [esp + 0xc0]
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x4a573f
mov dword [esp + 0x20], eax
xor eax, eax
mov esi, 0x14
test al, al
jne 0x4a729a
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov byte [esp + 0x88], al
mov eax, dword [0x55bd94]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], edx
movzx eax, byte [eax]
push 2
push esi
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x4a7295
mov ecx, 0xa
lea edx, [0x542d01]
mov esi, 1
mov word [eax], 0x63
mov dword [esp + 0x14c], ecx
lea ecx, [esp + 0x150]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], 1
mov dword [esp + 0x24], ecx
xor ecx, ecx
jmp 0x4a5040
mov eax, 0x542d00
mov dword [esp + 0x10], ecx
mov ecx, 0xaaaaaaab
mov dword [esp + 0xc], esi
mov esi, edx
mov ebx, edi
sub eax, edx
add eax, 0x1e
mul ecx
mov eax, edx
shr eax, 1
cmp di, 1
sbb eax, 0
add eax, 2
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14c]
mov edi, edx
push eax
call fcn.0046f8c0
add esp, 4
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x10]
mov edx, esi
mov esi, edi
mov edi, ebx
mov word [eax + esi*2], cx
inc esi
mov ecx, edi
mov dword [esp + 0x154], esi
test cx, cx
je 0x4a5060
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5032
jmp 0x4a4fe0
lea ecx, [0x542d1c]
cmp edx, ecx
je 0x4a515e
movzx ebx, byte [edx]
test bl, bl
js 0x4a5088
inc edx
mov ecx, ebx
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5032
jmp 0x4a4fe0
movzx edi, byte [edx + 1]
mov ecx, ebx
and ecx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x4a50f3
mov dword [esp + 0xc], esi
mov esi, ecx
mov ecx, edx
movzx edx, byte [edx + 2]
shl edi, 6
and edx, 0x3f
or edx, edi
cmp bl, 0xf0
jb 0x4a510f
movzx edi, byte [ecx + 3]
add ecx, 4
shl edx, 6
mov dword [esp + 0x10], ecx
mov ecx, esi
and ecx, 7
shl ecx, 0x12
and edi, 0x3f
or edi, edx
or ecx, edi
mov esi, dword [esp + 0xc]
cmp ecx, 0xffff
ja 0x4a5129
mov edx, dword [esp + 0x10]
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5032
jmp 0x4a4fe0
shl ecx, 6
add edx, 2
or ecx, edi
xor edi, edi
cmp esi, dword [esp + 0x14c]
jne 0x4a5032
jmp 0x4a4fe0
add ecx, 3
mov dword [esp + 0x10], ecx
mov ecx, esi
shl ecx, 0xc
or ecx, edx
mov esi, dword [esp + 0xc]
cmp ecx, 0xffff
jbe 0x4a50db
lea edx, [ecx + 0xff0000]
and ecx, 0x3ff
shr edx, 0xa
or ecx, 0xdc00
or edx, 0xd800
mov edi, ecx
mov ecx, edx
mov edx, dword [esp + 0x10]
cmp esi, dword [esp + 0x14c]
jne 0x4a5032
jmp 0x4a4fe0
movq xmm0, qword [esp + 0x14c]
mov esi, dword [esp + 0x154]
mov ebx, dword [esp + 0x1c]
movq qword [esp + 0x3c], xmm0
mov dword [esp + 0x44], esi
cmp esi, dword [esp + 0x3c]
jne 0x4a518b
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
lea eax, [ebx + ebx]
xor ecx, ecx
mov word [edi + esi*2], 0x22
inc esi
mov dword [esp + 0x44], esi
nop word cs:[eax + eax]
nop dword [eax]
cmp eax, ecx
je 0x4a57d0
cmp word [edx + ecx], 0x22
lea ecx, [ecx + 2]
jne 0x4a51b0
xor edi, edi
mov esi, 0x542d84
mov ebx, 2
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a51e7
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
mov eax, 0x80000000
and edi, 0xffffff00
movzx ebx, bl
or ebx, edi
cmp eax, 0x80000000
jne 0x4a5233
mov eax, dword [esp + 0x38]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a573d
add eax, eax
push 2
push eax
push dword [esp + 0xc8]
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a573d
cmp eax, esi
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], esi
jne 0x4a525f
lea ecx, [esp + 0xd8]
call fcn.0046fec0
mov ebx, dword [esp + 0xdc]
mov word [ebx + esi*2], 0
inc esi
mov eax, 0x400
mov ecx, 0x608
mov dword [esp + 0xe0], esi
mov esi, dword [esp + 8]
cmp byte [esi + 0x68], 0
cmove ecx, eax
or ecx, dword [esi + 0x58]
cmp dword [esp + 0x130], 0
mov dword [esp + 0x144], ecx
je 0x4a59f7
mov eax, dword [esp + 0x34]
mov edi, 2
mov ebx, 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 2
mov dword [esp + 0xa4], 0
mov dword [esp + 0x10], 0
mov esi, dword [eax + 8]
movq xmm0, qword [eax]
test esi, esi
mov dword [esp + 0x94], esi
movq qword [esp + 0x8c], xmm0
jne 0x4a5316
mov bl, 1
lea ecx, [esp + 0x9c]
call fcn.0046fec0
mov edi, dword [esp + 0xa0]
mov ebx, 1
mov word [edi], 0
mov dword [esp + 0xa4], 1
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
xor edx, edx
test eax, eax
setne dl
cmove esi, eax
mov dword [esp + 0x14c], edx
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], ecx
mov dword [esp + 0x15c], edx
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], ecx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
mov dword [esp + 0x16c], esi
call fcn.0046d030
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], edi
test ecx, ecx
je 0x4a683a
mov edx, dword [esp + 0x44]
lea eax, [edx + edx*8]
lea eax, [eax + eax*2]
add eax, edx
mov esi, dword [ecx + eax + 0xb4]
cmp esi, 0x80000000
je 0x4a683a
shl edx, 4
mov dword [esp + 0x84], esi
mov edi, dword [ecx + eax + 0xcc]
xor ebx, ebx
mov esi, dword [ecx + edx]
mov dword [esp + 0x148], edi
mov dword [esp + 0x24], esi
mov esi, dword [ecx + edx + 4]
mov edx, dword [ecx + edx + 8]
mov dword [esp + 0xc], esi
mov esi, dword [ecx + eax + 0xc4]
mov dword [esp + 0x14], edx
mov edx, dword [ecx + eax + 0xb8]
mov dword [esp + 0x80], esi
mov esi, dword [ecx + eax + 0xc8]
mov eax, dword [ecx + eax + 0xbc]
mov dword [esp + 0x110], edx
add eax, edx
mov dword [esp + 0x88], esi
mov dword [esp + 0x34], eax
jmp 0x4a542d
xor ebx, ebx
test si, si
je 0x4a5765
mov si, 1
test bx, bx
jne 0x4a5422
cmp edx, eax
je 0x4a54bf
movzx ebx, byte [edx]
test bl, bl
js 0x4a544a
inc edx
mov edi, ebx
jmp 0x4a54b6
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x4a5485
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x4a548f
movzx ecx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, eax
or edi, ecx
jmp 0x4a5497
shl edi, 6
add edx, 2
or edi, ecx
jmp 0x4a54b6
shl edi, 0xc
add edx, 3
or edi, eax
mov eax, dword [esp + 0x34]
cmp edi, 0xffff
jbe 0x4a54b6
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x4a5424
xor ebx, ebx
mov esi, edi
jmp 0x4a5424
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a54dc
push 1
push eax
push dword [esp + 0x118]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x9c]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x148]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0xc]
sub eax, edi
cmp eax, esi
jae 0x4a551c
mov edx, edi
lea ecx, [esp + 0x9c]
push esi
call fcn.0046f8c0
add esp, 4
mov ecx, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
lea eax, [esi + esi]
mov dword [esp + 0x2c], ecx
lea ecx, [ecx + edi*2]
push eax
push dword [esp + 0x8c]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x80]
add edi, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0xa4], edi
test eax, eax
je 0x4a5563
add eax, eax
push 2
push eax
push dword [esp + 0x90]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
cmp eax, dword [esp + 0x9c]
jne 0x4a5587
lea ecx, [esp + 0x9c]
call fcn.0046fec0
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x1c]
and dword [esp + 0x110], 0xffffff00
xor edi, edi
mov word [ecx + eax*2], 0x3d
inc eax
mov ecx, ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x14]
add eax, ebx
mov dword [esp + 0x10], eax
jmp 0x4a55bf
xor edi, edi
test dx, dx
je 0x4a6159
mov dx, 1
test di, di
jne 0x4a55b4
cmp ecx, eax
je 0x4a5661
movzx ebx, byte [ecx]
test bl, bl
js 0x4a55e0
mov esi, ebx
mov ebx, dword [esp + 0xc]
inc ecx
jmp 0x4a5658
movzx eax, byte [ecx + 1]
mov esi, ebx
and esi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x4a561b
movzx edi, byte [ecx + 2]
shl eax, 6
and edi, 0x3f
or edi, eax
cmp bl, 0xf0
jb 0x4a562d
movzx eax, byte [ecx + 3]
and esi, 7
shl edi, 6
add ecx, 4
shl esi, 0x12
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x4a5635
shl esi, 6
mov ebx, dword [esp + 0xc]
add ecx, 2
or esi, eax
mov eax, dword [esp + 0x10]
jmp 0x4a5658
shl esi, 0xc
add ecx, 3
or esi, edi
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp esi, 0xffff
jbe 0x4a5658
and esi, 0x3ff
or esi, 0xdc00
mov edi, esi
jmp 0x4a55b6
xor edi, edi
mov edx, esi
jmp 0x4a55b6
mov edi, ebx
shr edi, 8
cmp dword [esp + 0x24], 0x80000000
je 0x4a7088
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], eax
mov word [esp + 0xec], 0
lea ecx, [esp + 0x9c]
lea edx, [esp + 0xe4]
call fcn.0047af20
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a56b3
push 1
push eax
push ebx
call fcn.0040d1e0
add esp, 0xc
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x140], edi
cmp ebx, dword [esp + 0x9c]
jne 0x4a56d6
lea ecx, [esp + 0x9c]
call fcn.0046fec0
mov edi, dword [esp + 0xa0]
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
mov word [edi + ebx*2], 0
inc ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xa4], ebx
jmp 0x4a5380
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0xe4]
mov esi, dword [esp + 0xe8]
test eax, eax
je 0x4a572d
add eax, eax
push 2
push eax
push dword [esp + 0x48]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x38]
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 2
xor ebx, ebx
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4a5758
add eax, eax
push 2
push eax
push dword [esp + 0x20]
call fcn.0040d1e0
add esp, 0xc
test bl, bl
je 0x4a4231
jmp 0x4a434e
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a5782
push 1
push eax
push dword [esp + 0x118]
call fcn.0040d1e0
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
test ecx, ecx
je 0x4a579a
push 1
push ecx
push eax
call fcn.0040d1e0
add esp, 0xc
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x88]
or dword [esp + 0x10], 2
mov dword [esp + 0x14], 0x5432d4
test ecx, ecx
je 0x4a618a
add ecx, ecx
push 2
push ecx
push eax
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a618a
mov eax, dword [esp + 0x18]
mov edx, edi
xor edi, edi
mov ecx, ebx
sub ebx, 1
jb 0x4a61e2
mov ecx, eax
movzx eax, word [eax + ebx*2]
cmp ax, 0x5c
jne 0x4a61d4
mov esi, 0x542d84
jmp 0x4a6822
mov dword [esp + 0x30], 1
test edx, edx
je 0x4a5947
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], edx
add eax, edx
mov dword [esp + 0x40], eax
mov word [esp + 0x44], 0
mov byte [esp + 0x48], 1
lea eax, [esp + 0x3c]
lea esi, [esp + 0x14c]
push eax
push esi
call fcn.004a19a0
add esp, 8
jmp 0x4a584c
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.004a19a0
add esp, 8
mov eax, dword [esp + 0x14c]
cmp eax, 0x80000000
je 0x4a5947
mov edx, dword [esp + 0x154]
mov ecx, dword [esp + 0x150]
test edx, edx
je 0x4a592e
mov edi, dword [esp + 0x158]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], edx
mov dword [esp + 0x158], edi
push dword [esp + 0x18]
push ebx
push esi
call fcn.00492f90
add esp, 0xc
cmp dword [esp + 0x30], 1
je 0x4a58bc
push 3
push str.exe.NULexit_code:
push esi
call fcn.00493bb0
add esp, 0xc
mov edi, dword [esp + 0x150]
mov edx, edi
lea ecx, [esp + 0xe4]
push dword [esp + 0x154]
call fcn.004a7aa0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a58f2
push 1
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0xe4]
cmp edi, 0x80000000
jne 0x4a5d06
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.004a19a0
add esp, 8
mov eax, dword [esp + 0x14c]
mov ebx, dword [esp + 0xc0]
cmp eax, 0x80000000
jne 0x4a585e
jmp 0x4a5947
test eax, eax
je 0x4a583e
push 1
push eax
push ecx
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a583e
lea ecx, [esp + 0x3c]
call fcn.004a1bd0
mov esi, dword [esp + 0x3c]
cmp esi, 0x80000000
jne 0x4a59a2
cmp byte [esp + 0x40], 3
jne 0x4a5b18
mov esi, dword [esp + 0x44]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x4a597c
push edi
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x4a5990
push dword [ebx + 8]
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
push 4
push 0xc
push esi
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a5b18
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0xc], eax
push ebx
push edi
call fcn.00494110
add esp, 8
test eax, eax
je 0x4a5a7d
test edx, edx
je 0x4a5a7b
cmp ebx, edx
jbe 0x4a5a71
cmp byte [edi + edx], 0xbf
jg 0x4a5a77
push 0x542254
push 0x37
push 0x54221a
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
xor ebx, ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0x2c], 0
cmp dword [esi + 0x34], 0x80000000
mov dword [esp + 0xc], ebx
jne 0x4a68b5
mov edi, 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x88], 0
pxor xmm0, xmm0
mov cl, 1
xor eax, eax
movdqu xmmword [esp + 0x9c], xmm0
lock cmpxchg byte [0x586160], cl
jne 0x4a69fc
mov eax, dword [0x58613c]
mov dword [esp + 0x34], edi
test eax, 0x7fffffff
je 0x4a6a1d
call fcn.0049a990
xor al, 1
jmp 0x4a6a1f
jne 0x4a59de
cmp ebx, edx
jb 0x4a5a7d
mov ebx, edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], edi
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], eax
lea esi, [esp + 0x14c]
push dword [esp + 0x18]
push dword [esp + 0xc4]
push esi
call fcn.00492f90
add esp, 0xc
cmp dword [esp + 0x30], 1
je 0x4a5acf
push 3
push str.exe.NULexit_code:
push esi
call fcn.00493bb0
add esp, 0xc
mov esi, dword [esp + 0x150]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x154]
call fcn.004a7aa0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a5b05
push 1
push eax
push esi
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0xe4]
cmp edi, 0x80000000
jne 0x4a5d06
mov eax, 0x200
xor ebx, ebx
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 2
mov dword [esp + 0xa4], 0
mov dword [esp + 0x10], 2
cmp eax, 0x201
jb 0x4a5b74
jmp 0x4a5b90
mov edi, dword [esp + 0xc0]
jbe 0x4a5c2d
cmp eax, 0x201
jae 0x4a5b90
mov dword [esp + 0xc], 0x200
lea esi, [esp + 0x14c]
mov edi, eax
jmp 0x4a5bc9
sub eax, ebx
je 0x4a5bb8
mov edx, ebx
lea ecx, [esp + 0x9c]
push eax
call fcn.0046f8c0
add esp, 4
mov ebx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
mov edi, ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xc], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push esi
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
jne 0x4a5bfa
mov dword [esp + 0x14], esi
mov esi, ebx
mov ebx, eax
call sub.kernel32.dll_GetLastError
mov ecx, eax
mov eax, ebx
mov ebx, esi
mov esi, dword [esp + 0x14]
test ecx, ecx
jne 0x4a5d19
cmp eax, edi
jne 0x4a5b60
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a71b7
lea eax, [edi + edi]
test edi, edi
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, 0x201
jae 0x4a5b90
jmp 0x4a5b74
mov ecx, dword [esp + 0xc]
cmp eax, ecx
ja 0x4a72a6
push eax
push esi
lea esi, [esp + 0x44]
push esi
call fcn.00491170
add esp, 0xc
push dword [esp + 0x18]
push edi
push esi
call fcn.00492f90
add esp, 0xc
cmp dword [esp + 0x30], 1
je 0x4a5c71
push 3
push str.exe.NULexit_code:
lea eax, [esp + 0x44]
push eax
call fcn.00493bb0
add esp, 0xc
mov esi, dword [esp + 0x40]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x44]
call fcn.004a7aa0
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a5c9e
push 1
push eax
push esi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x9c]
mov edi, dword [esp + 0xe4]
mov esi, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
test eax, eax
je 0x4a5cd2
add eax, eax
push 2
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
cmp edi, 0x80000001
jg 0x4a6d4d
mov ecx, edi
cmp edi, 0x80000000
je 0x4a5d77
mov eax, esi
cmp ecx, 0x80000001
je 0x4a5d41
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 2
jmp 0x4a5d6f
mov ecx, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
jmp 0x4a47ba
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4a5d3f
add eax, eax
push 2
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
xor eax, eax
cmp al, 3
jne 0x4a5d77
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x4a5d56
push esi
call eax
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4a5d6a
push dword [edi + 8]
push eax
push esi
call fcn.0040d1e0
add esp, 0xc
push 4
push 0xc
push ebx
call fcn.0040d1e0
add esp, 0xc
mov ebx, 0x200
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 2
mov dword [esp + 0xa4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 2
cmp ebx, 0x201
jb 0x4a5dd5
jmp 0x4a5df0
mov edi, dword [esp + 0xc0]
jbe 0x4a5e84
cmp ebx, 0x201
jae 0x4a5df0
mov dword [esp + 0x10], 0x200
lea esi, [esp + 0x14c]
mov edi, ebx
jmp 0x4a5e2f
mov edi, dword [esp + 0xc]
sub ebx, edi
je 0x4a5e1c
mov edx, edi
lea ecx, [esp + 0x9c]
push ebx
call fcn.0046f8c0
add esp, 4
mov edi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x14]
mov dword [esp + 0xa4], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
push 0
call sub.kernel32.dll_SetLastError
push edi
push esi
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebx, eax
test eax, eax
jne 0x4a5e50
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4a5f6e
cmp ebx, edi
jne 0x4a5dc0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4a71d0
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x4a5df0
jmp 0x4a5dd5
mov eax, dword [esp + 0x10]
cmp ebx, eax
ja 0x4a72b7
push ebx
push esi
lea esi, [esp + 0x44]
push esi
call fcn.00491170
add esp, 0xc
push dword [esp + 0x18]
push edi
push esi
call fcn.00492f90
add esp, 0xc
cmp dword [esp + 0x30], 1
je 0x4a5ec8
push 3
push str.exe.NULexit_code:
lea eax, [esp + 0x44]
push eax
call fcn.00493bb0
add esp, 0xc
mov esi, dword [esp + 0x40]
mov edx, esi
lea ecx, [esp + 0xe4]
push dword [esp + 0x44]
call fcn.004a7aa0
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4a5ef5
push 1
push eax
push esi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x9c]
mov edi, dword [esp + 0xe4]
mov esi, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
test eax, eax
je 0x4a5f29
add eax, eax
push 2
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
cmp edi, 0x80000001
jg 0x4a6d4d
mov eax, edi
cmp edi, 0x80000000
mov edi, dword [esp + 0xc0]
je 0x4a5fda
mov ecx, eax
mov eax, esi
cmp ecx, 0x80000001
je 0x4a5f9d
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 8], 2
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a5fda
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, dword [esp + 0x9c]
mov edi, dword [esp + 0xc0]
test eax, eax
je 0x4a5f9b
add eax, eax
push 2
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
xor eax, eax
cmp al, 3
jne 0x4a5fda
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x4a5fb2
push esi
call eax
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4a5fc6
push dword [edi + 8]
push eax
push esi
call fcn.0040d1e0
add esp, 0xc
push 4
push 0xc
push ebx
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0xc0]
lea eax, [esp + 0xe4]
push 4
push 0x54219c
push eax
call fcn.004849e0
add esp, 0xc
mov ebx, dword [esp + 0xe4]
cmp ebx, 0x80000000
je 0x4a6141
mov ecx, dword [esp + 0xe8]
mov eax, dword [esp + 0xec]
lea esi, [esp + 0x14c]
mov dword [esp + 0xc], ebx
add eax, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x40], eax
mov word [esp + 0x44], 0
mov byte [esp + 0x48], 1
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.004a19a0
add esp, 8
jmp 0x4a6055
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.004a19a0
add esp, 8
mov eax, dword [esp + 0x14c]
cmp eax, 0x80000000
je 0x4a612e
mov edx, dword [esp + 0x154]
mov ecx, dword [esp + 0x150]
test edx, edx
jne 0x4a608b
test eax, eax
je 0x4a6047
push 1
push eax
push ecx
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a6047
mov ebx, edi
mov edi, dword [esp + 0x158]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], edx
mov dword [esp + 0x158], edi
push dword [esp + 0x18]
push ebx
push esi
call fcn.00492f90
add esp, 0xc
cmp dword [esp + 0x30], 1
je 0x4a60d5
push 3
push str.exe.NULexit_code:
push esi
call fcn.00493bb0
add esp, 0xc
mov edi, dword [esp + 0x150]
mov edx, edi
lea ecx, [esp + 0x9c]
push dword [esp + 0x154]
call fcn.004a7aa0
add esp, 4
mov eax, dword [esp + 0x14c]
test eax, eax
je 0x4a610b
push 1
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0x9c]
mov ebx, dword [esp + 0xc]
cmp edi, 0x80000000
jne 0x4a6d2a
mov edi, dword [esp + 0xc0]
jmp 0x4a6037
test ebx, ebx
je 0x4a6141
push 1
push ebx
push dword [esp + 0x18]
call fcn.0040d1e0
add esp, 0xc
mov byte [esp + 0x90], 2
mov dword [esp + 0x94], 0x543324
jmp 0x4a4213
mov eax, dword [esp + 0x24]
mov esi, 2
mov dword [esp + 0x14], 0x5432d4
test eax, eax
je 0x4a617a
push 1
push eax
push ebx
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0x140]
shl edi, 8
or edi, esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ecx, [esp + 0x14c]
call fcn.00460fd0
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x4a61b7
add eax, eax
push 2
push eax
push dword [esp + 0xa8]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], 2
jmp 0x4a703b
xor edi, edi
test ax, ax
mov eax, ecx
cmove edi, ecx
mov ecx, dword [esp + 0x1c]
test edi, edi
cmove ebx, ecx
mov ecx, dword [esp + 0x3c]
cmove edi, eax
mov eax, ecx
sub eax, esi
cmp eax, ebx
jae 0x4a6217
mov edx, esi
lea ecx, [esp + 0x3c]
push ebx
call fcn.0046f8c0
add esp, 4
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], eax
jmp 0x4a621b
mov dword [esp + 0xc], ecx
lea eax, [ebx + ebx]
lea ecx, [edx + esi*2]
push eax
push edi
push ecx
mov edi, edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add esi, ebx
mov eax, edi
cmp esi, dword [esp + 0xc]
mov dword [esp + 0x44], esi
jne 0x4a6249
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax + esi*2], 0x22
mov eax, dword [esp + 0x14]
inc esi
mov dword [esp + 0x44], esi
test eax, eax
je 0x4a6cc5
mov ecx, dword [esp + 0x2c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov dword [esp + 0x24], eax
mov edi, dword [esp + 0x44]
cmp edi, dword [esp + 0x3c]
jne 0x4a6281
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
lea ebx, [edi + 1]
mov word [eax + edi*2], 0x20
mov dword [esp + 0x44], ebx
cmp dword [esi], 0
je 0x4a62dc
movzx eax, byte [esp + 0x88]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x14c]
push eax
push esi
call fcn.0049c540
add esp, 8
cmp byte [esp + 0x14c], 4
jne 0x4a6d03
mov eax, dword [esp + 0x2c]
add eax, 0x14
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
jne 0x4a626e
jmp 0x4a6cc1
mov dword [esp + 0x84], edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 8]
mov dword [esp + 0x80], eax
add eax, edi
mov dword [esp + 0xc], eax
mov eax, edi
jmp 0x4a6307
inc eax
cmp dl, cl
je 0x4a6800
cmp eax, dword [esp + 0xc]
je 0x4a6334
movzx ecx, byte [eax]
mov esi, 0xffffffff
nop word cs:[eax + eax]
nop
movzx edx, byte [esi + 0x542d91]
cmp dl, cl
je 0x4a62fe
test esi, esi
lea esi, [esi + 1]
jne 0x4a6320
jmp 0x4a62fe
xor eax, eax
mov ecx, edi
mov dword [esp + 0x1c], edi
jmp 0x4a6349
xor eax, eax
test dx, dx
je 0x4a681d
mov dx, 1
test ax, ax
jne 0x4a633e
cmp ecx, dword [esp + 0xc]
je 0x4a63ed
movzx eax, byte [ecx]
test al, al
js 0x4a6368
inc ecx
mov esi, eax
jmp 0x4a63e4
movzx edi, byte [ecx + 1]
mov esi, eax
and esi, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x4a63ab
mov dword [esp + 0x14], ecx
movzx ecx, byte [ecx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp al, 0xf0
mov edi, ecx
jb 0x4a63b9
mov ecx, dword [esp + 0x14]
and esi, 7
shl edi, 6
shl esi, 0x12
movzx eax, byte [ecx + 3]
add ecx, 4
and eax, 0x3f
or eax, edi
or esi, eax
jmp 0x4a63c5
shl esi, 6
add ecx, 2
or esi, edi
mov edi, dword [esp + 0x1c]
jmp 0x4a63e4
mov ecx, dword [esp + 0x14]
shl esi, 0xc
or esi, edi
add ecx, 3
mov edi, dword [esp + 0x1c]
cmp esi, 0xffff
jbe 0x4a63e4
and esi, 0x3ff
or esi, 0xdc00
mov eax, esi
jmp 0x4a6340
xor eax, eax
mov edx, esi
jmp 0x4a6340
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x4a64f5
cmp byte [esp + 0x88], 0
setne al
cmp byte [ecx + edi - 1], 0x5c
sete cl
or cl, al
mov byte [esp + 0x14], cl
jmp 0x4a6426
mov byte [esp + 0x14], 1
cmp edi, dword [esp + 0xc]
je 0x4a64df
movzx eax, byte [edi]
test al, al
js 0x4a6432
inc edi
mov esi, eax
jmp 0x4a647d
movzx edx, byte [edi + 1]
mov esi, eax
and esi, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x4a646b
movzx ecx, byte [edi + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp al, 0xf0
jb 0x4a6475
movzx eax, byte [edi + 3]
and esi, 7
shl ecx, 6
add edi, 4
shl esi, 0x12
and eax, 0x3f
or eax, ecx
or esi, eax
jmp 0x4a647d
shl esi, 6
add edi, 2
or esi, edx
jmp 0x4a647d
shl esi, 0xc
add edi, 3
or esi, ecx
cmp esi, 0x110000
je 0x4a641c
mov eax, esi
and eax, 0x1ff800
cmp eax, 0xd800
je 0x4a641c
cmp esi, 0x80
jae 0x4a64c9
lea eax, [esi - 0x30]
cmp eax, 0xa
jb 0x4a64c9
mov eax, esi
and eax, 0x5f
add eax, 0xffffffbf
cmp eax, 0x19
jbe 0x4a64c9
push 0xc
push 0x542cf4
push esi
call fcn.004e1300
add esp, 0xc
cmp eax, 1
jne 0x4a6417
push esi
call fcn.004f2040
add esp, 4
test al, al
jne 0x4a6417
jmp 0x4a641c
test byte [esp + 0x14], 1
jne 0x4a64f5
mov al, 1
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
jmp 0x4a652c
cmp ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x84]
jne 0x4a6513
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax + ebx*2 + 2], 0x22
add ebx, 2
mov dword [esp + 0x84], 0
mov dword [esp + 0x44], ebx
xor esi, esi
xor edi, edi
jmp 0x4a6543
mov eax, dword [esp + 0x40]
mov word [eax + ebx*2], si
inc ebx
mov esi, dword [esp + 0x14]
mov dword [esp + 0x44], ebx
test si, si
mov dword [esp + 0x10], eax
je 0x4a6559
mov dword [esp + 0x14], 0
jmp 0x4a6627
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0xc]
je 0x4a675b
movzx eax, byte [ecx]
test al, al
js 0x4a6582
inc ecx
mov esi, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ecx
jmp 0x4a6627
movzx edx, byte [ecx + 1]
mov esi, eax
and esi, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x4a65d9
mov dword [esp + 0x80], edx
movzx edx, byte [ecx + 2]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x80]
and dword [esp + 0x14], 0x3f
shl edx, 6
add dword [esp + 0x14], edx
cmp al, 0xf0
mov edx, dword [esp + 0x14]
jb 0x4a65ef
movzx eax, byte [ecx + 3]
and esi, 7
shl edx, 6
add ecx, 4
shl esi, 0x12
mov dword [esp + 0x1c], ecx
and eax, 0x3f
or eax, edx
or esi, eax
jmp 0x4a65fb
shl esi, 6
add ecx, 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ecx
or esi, edx
jmp 0x4a6627
shl esi, 0xc
add ecx, 3
mov dword [esp + 0x1c], ecx
or esi, edx
cmp esi, 0xffff
jbe 0x4a654c
lea eax, [esi + 0xff0000]
and esi, 0x3ff
shr eax, 0xa
or esi, 0xdc00
mov dword [esp + 0x14], esi
or eax, 0xd800
mov esi, eax
movzx eax, si
cmp eax, 0x24
jg 0x4a6666
cmp eax, 0xd
je 0x4a6673
cmp eax, 0x22
jne 0x4a6698
mov eax, dword [esp + 0x3c]
mov ecx, eax
sub ecx, ebx
cmp ecx, edi
jae 0x4a66ca
mov edx, ebx
lea ecx, [esp + 0x3c]
push edi
call fcn.0046f8c0
add esp, 4
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
jmp 0x4a66ce
cmp eax, 0x25
je 0x4a6673
cmp eax, 0x5c
jne 0x4a6698
inc edi
jmp 0x4a669a
mov eax, dword [esp + 0x3c]
sub eax, ebx
cmp eax, 6
ja 0x4a66a3
mov edx, ebx
lea ecx, [esp + 0x3c]
push 7
call fcn.0046f8c0
add esp, 4
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
jmp 0x4a66a7
xor edi, edi
mov eax, dword [esp + 0x10]
jmp 0x4a6743
mov eax, dword [esp + 0x10]
mov word [eax + ebx*2 + 0xc], 0x2c
mov dword [eax + ebx*2 + 8], 0x7e003a
mov dword [eax + ebx*2 + 4], 0x640063
mov dword [eax + ebx*2], 0x250025
add ebx, 7
jmp 0x4a673d
test edi, edi
je 0x4a671d
xor eax, eax
cmp edi, 0x10
jae 0x4a66db
mov ecx, dword [esp + 0x10]
jmp 0x4a670d
mov ecx, dword [esp + 0x10]
movdqa xmm0, xmmword [0x53f890]
mov eax, edi
and eax, 0xfffffff0
mov edx, eax
lea ecx, [ecx + ebx*2 + 0x10]
add ebx, eax
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x4a66f4
mov ecx, dword [esp + 0x10]
cmp edi, eax
je 0x4a6719
sub edi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec edi
jne 0x4a670f
mov eax, dword [esp + 0x3c]
cmp ebx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], ebx
jne 0x4a6736
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x40]
mov word [eax + ebx*2], 0x22
inc ebx
mov dword [esp + 0x44], ebx
xor edi, edi
cmp ebx, dword [esp + 0x3c]
jne 0x4a6536
lea ecx, [esp + 0x3c]
call fcn.0046fec0
jmp 0x4a6532
cmp byte [esp + 0x84], 0
jne 0x4a62c6
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, eax
sub ecx, ebx
cmp ecx, edi
jae 0x4a6790
mov edx, ebx
lea ecx, [esp + 0x3c]
push edi
call fcn.0046f8c0
add esp, 4
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
jmp 0x4a6794
test edi, edi
je 0x4a67db
xor eax, eax
cmp edi, 0x10
jae 0x4a679f
mov ecx, esi
jmp 0x4a67cb
movdqa xmm0, xmmword [0x53f890]
mov eax, edi
lea ecx, [esi + ebx*2 + 0x10]
and eax, 0xfffffff0
add ebx, eax
mov edx, eax
movdqu xmmword [ecx - 0x10], xmm0
movdqu xmmword [ecx], xmm0
add ecx, 0x20
add edx, 0xfffffff0
jne 0x4a67b4
cmp edi, eax
mov ecx, esi
je 0x4a67d7
sub edi, eax
mov word [ecx + ebx*2], 0x5c
inc ebx
dec edi
jne 0x4a67cd
mov eax, dword [esp + 0x3c]
cmp ebx, eax
mov dword [esp + 0x44], ebx
jne 0x4a67f0
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov esi, dword [esp + 0x40]
mov word [esi + ebx*2], 0x22
inc ebx
mov dword [esp + 0x44], ebx
jmp 0x4a62c6
xor edi, edi
mov esi, 0x542d40
mov ebx, 2
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a51d6
jmp 0x4a51e7
mov esi, 0x5432d4
mov ebx, 2
xor edi, edi
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a51d6
jmp 0x4a51e7
xor ebx, ebx
lea ecx, [esp + 0x14c]
call fcn.00460fd0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp ecx, dword [esp + 0x9c]
jne 0x4a6872
xor ebx, ebx
lea ecx, [esp + 0x9c]
call fcn.0046fec0
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x1c]
mov word [eax + ecx*2], 0
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
cmp ebx, 0x80000000
mov dword [esp + 0x10], eax
jne 0x4a68a0
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x4a61b7
mov esi, dword [esp + 8]
cmp dword [esi + 0x34], 0x80000000
mov dword [esp + 0xc], ebx
je 0x4a5a1a
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x14], eax
jmp 0x4a68d4
xor ebx, ebx
test si, si
je 0x4a6966
mov si, 1
test bx, bx
jne 0x4a68c9
cmp edx, eax
je 0x4a6989
movzx ebx, byte [edx]
test bl, bl
js 0x4a68f1
inc edx
mov edi, ebx
jmp 0x4a695d
movzx ecx, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and ecx, 0x3f
cmp bl, 0xdf
jbe 0x4a692c
movzx eax, byte [edx + 2]
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp bl, 0xf0
jb 0x4a6936
movzx ecx, byte [edx + 3]
and edi, 7
shl eax, 6
add edx, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, eax
or edi, ecx
jmp 0x4a693e
shl edi, 6
add edx, 2
or edi, ecx
jmp 0x4a695d
shl edi, 0xc
add edx, 3
or edi, eax
mov eax, dword [esp + 0x14]
cmp edi, 0xffff
jbe 0x4a695d
and edi, 0x3ff
or edi, 0xdc00
mov ebx, edi
jmp 0x4a68cb
xor ebx, ebx
mov esi, edi
jmp 0x4a68cb
mov ebx, dword [esp + 0xc]
mov esi, 0x5432d4
mov edi, 2
mov eax, dword [esp + 0x38]
mov dword [eax + 4], esi
mov dword [eax], edi
mov dword [eax + 8], 2
jmp 0x4a7026
mov esi, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x14c], esi
mov dword [esp + 0x150], ecx
mov word [esp + 0x154], 0
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x14c]
call fcn.0047b080
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x44]
mov ebx, dword [esp + 0xc]
cmp esi, eax
jne 0x4a69d4
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
cmp eax, 0x80000000
mov dword [esp + 0x14], eax
mov word [edi + esi*2], 0
jne 0x4a69ec
inc esi
jmp 0x4a6974
mov esi, dword [esp + 8]
mov dword [esp + 0x88], edi
jmp 0x4a5a32
push 0x586160
call fcn.004acb30
add esp, 4
mov eax, dword [0x58613c]
mov dword [esp + 0x34], edi
test eax, 0x7fffffff
jne 0x4a5a65
xor eax, eax
movzx edx, byte [0x586161]
movzx ecx, byte [ebp + 0xc]
xor ebx, ebx
mov dword [esp + 0x120], 0x586160
mov byte [esp + 0x124], al
lea eax, [esp + 0x128]
lea edi, [esi + 8]
mov dword [esp + 0xe4], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0x114], 2
test dl, dl
lea edx, [esp + 0x114]
setne bl
test cl, cl
mov ecx, esi
cmovne edx, eax
cmp dword [esi], 6
mov dword [esp + 0x11c], ebx
cmovne edx, esi
cmp dword [esi + 8], 6
lea esi, [esi + 0x10]
cmove edi, eax
cmp dword [ecx + 0x10], 6
cmove esi, eax
lea eax, [esp + 0xe4]
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff6
call fcn.004a7bb0
add esp, 8
movzx eax, byte [esp + 0x14c]
cmp al, 4
jne 0x4a6c17
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0xec]
mov dword [esp + 0x1c], ecx
mov edx, edi
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff5
call fcn.004a7bb0
add esp, 8
movzx eax, byte [esp + 0x14c]
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x34]
cmp al, 4
jne 0x4a6c52
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0xf4]
mov dword [esp + 0x24], ecx
mov edx, esi
lea ecx, [esp + 0x14c]
push eax
push 0xfffffffffffffff4
call fcn.004a7bb0
add esp, 8
movzx eax, byte [esp + 0x14c]
mov edx, dword [esp + 8]
cmp al, 4
jne 0x4a6c89
mov esi, dword [esp + 0x150]
cmp dword [esp + 0x1c], 0
pxor xmm0, xmm0
mov dword [esp + 0x7c], 0
movdqu xmmword [esp + 0x6c], xmm0
movdqu xmmword [esp + 0x5c], xmm0
movdqu xmmword [esp + 0x4c], xmm0
movdqu xmmword [esp + 0x3c], xmm0
jne 0x4a6b88
cmp dword [esp + 0x24], 0
jne 0x4a6b88
mov eax, 1
test esi, esi
je 0x4a6ba9
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x78], eax
mov eax, 0x101
mov dword [esp + 0x7c], esi
cmp word [edx + 0x44], 0
je 0x4a6bbd
movzx ecx, word [edx + 0x46]
mov dword [esp + 0x68], eax
mov word [esp + 0x6c], cx
mov eax, dword [edx + 0x64]
test eax, eax
mov dword [esp + 0x80], eax
je 0x4a6cf2
add edx, 0x5c
mov dword [esp + 0x3c], 0x48
lea ecx, [esp + 0x8c]
call fcn.004a8360
cmp dword [esp + 0x8c], 0
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
je 0x4a6d56
mov eax, dword [esp + 0x38]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x4a6f42
mov edx, dword [esp + 0x38]
movzx edi, word [esp + 0x14d]
movzx ecx, byte [esp + 0x14f]
mov esi, dword [esp + 0x150]
mov ebx, dword [esp + 0xc]
mov word [edx + 1], di
mov edi, dword [esp + 0x34]
mov byte [edx + 3], cl
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x4a6f72
movzx ecx, byte [esp + 0x14f]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x150]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x14d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
push dword [esp + 0x1c]
jmp 0x4a6f6d
movzx ecx, byte [esp + 0x14f]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x150]
mov byte [edx + 3], cl
movzx ecx, word [esp + 0x14d]
mov word [edx + 1], cx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, 2
mov dword [edx + 8], 2
jmp 0x4a6f4f
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
cmp esi, eax
jne 0x4a6cda
lea ecx, [esp + 0x3c]
call fcn.0046fec0
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
mov edi, ebx
mov word [ebx + esi*2], 0x22
inc esi
and edi, 0xffffff00
jmp 0x4a51ec
mov dword [esp + 0x3c], 0x44
lea ecx, [esp + 0x3c]
jmp 0x4a6d9e
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x150]
mov edi, ebx
and edi, 0xffffff00
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4a51d6
jmp 0x4a51e7
mov eax, ebx
mov esi, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
test eax, eax
je 0x4a6d4d
push 1
push eax
push dword [esp + 0x18]
call fcn.0040d1e0
add esp, 0xc
mov eax, esi
mov ecx, esi
jmp 0x4a47ba
mov dword [esp + 8], ecx
mov dword [esp + 0x110], esi
mov eax, edi
or dword [esp + 0x144], 0x80000
lea esi, [esp + 0x3c]
mov ecx, 0x11
lea edi, [esp + 0x14c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14c]
mov edi, eax
mov dword [esp + 0x84], edx
mov dword [esp + 0x190], edx
mov esi, dword [esp + 0x110]
lea eax, [esp + 0x9c]
push eax
push ecx
push dword [esp + 0x90]
push dword [esp + 0x38]
push dword [esp + 0x154]
push 1
push 0
push 0
push dword [esp + 0xfc]
push dword [esp + 0xe4]
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4a6efc
mov eax, dword [esp + 0x38]
movsd xmm1, qword [esp + 0xec]
cmp dword [esp + 0x80], 0
movq xmm0, qword [esp + 0xf4]
movsd xmm2, qword [esp + 0xe4]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x9c]
movq qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x4a6e2f
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 8]
call fcn.00462720
push esi
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x24]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x1c]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0x114], 4
jb 0x4a6e5d
push dword [esp + 0x118]
call sub.kernel32.dll_CloseHandle
lea ecx, [esp + 0x11c]
call fcn.00461540
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a6e7f
add eax, eax
push 2
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
test ebx, ebx
je 0x4a6e94
add ebx, ebx
push 2
push ebx
push dword [esp + 0x18]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x4a6eb3
add eax, eax
push 2
push eax
push dword [esp + 0xe4]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a6ecf
add eax, eax
push 2
push eax
push dword [esp + 0xc8]
call fcn.0040d1e0
add esp, 0xc
cmp byte [esp + 0x28], 0
mov eax, dword [esp + 0x30]
je 0x4a434e
test eax, eax
je 0x4a434e
add eax, eax
push 2
push eax
push dword [esp + 0x20]
call fcn.0040d1e0
add esp, 0xc
jmp 0x4a434e
call sub.kernel32.dll_GetLastError
movzx ecx, word [esp + 0x8c]
mov edx, dword [esp + 0x38]
cmp dword [esp + 0x80], 0
mov word [edx + 1], cx
mov ch, byte [esp + 0x8e]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x4a6f42
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 8]
call fcn.00462720
push esi
call sub.kernel32.dll_CloseHandle
mov esi, dword [esp + 0x114]
push dword [esp + 0x24]
call sub.kernel32.dll_CloseHandle
push dword [esp + 0x1c]
call sub.kernel32.dll_CloseHandle
cmp esi, 4
jb 0x4a6f72
push dword [esp + 0x118]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xe4], 0
je 0x4a6f88
push dword [esp + 0xe8]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xec], 0
je 0x4a6f9e
push dword [esp + 0xf0]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0xf4], 0
je 0x4a6fb4
push dword [esp + 0xf8]
call sub.kernel32.dll_CloseHandle
cmp dword [esp + 0x11c], 0
mov esi, dword [esp + 0x120]
movzx eax, byte [esp + 0x124]
je 0x4a6fe4
test al, al
jne 0x4a7001
mov eax, dword [0x58613c]
test eax, 0x7fffffff
je 0x4a7001
call fcn.0049a990
jmp 0x4a6ff9
test al, al
jne 0x4a7001
mov eax, dword [0x58613c]
test eax, 0x7fffffff
je 0x4a7001
call fcn.0049a990
test al, al
jne 0x4a7001
mov byte [esi + 1], 1
xor eax, eax
xchg byte [esi], al
cmp al, 2
jne 0x4a7010
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a7026
add eax, eax
push 2
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
test ebx, ebx
je 0x4a703b
add ebx, ebx
push 2
push ebx
push dword [esp + 0x18]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x4a705a
add eax, eax
push 2
push eax
push dword [esp + 0xe4]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4a7076
add eax, eax
push 2
push eax
push dword [esp + 0xc8]
call fcn.0040d1e0
add esp, 0xc
cmp byte [esp + 0x28], 0
mov bl, 1
jne 0x4a573f
jmp 0x4a434e
movzx esi, bl
jmp 0x4a6181
call sub.kernel32.dll_GetLastError
mov byte [esp + 0xe4], 0
mov dword [esp + 0xe8], eax
lea eax, [esp + 0xe4]
mov dword [esp + 0x3c], 0x543270
mov dword [esp + 0x40], 1
mov dword [esp + 0x4c], 0
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0xa0], 0x488d10
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 1
push 0x5432a4
lea eax, [esp + 0x40]
push eax
call fcn.004dc2b0
add esp, 8
jmp 0x4a72c6
xor eax, eax
jmp 0x4a713e
mov eax, 1
jmp 0x4a710c
xor eax, eax
push dword [esp + 0x18]
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
mov eax, 2
jmp 0x4a7127
xor eax, eax
push dword [esp + 0x14]
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
mov eax, 1
push edi
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
push 0x5438b0
push 0x28
push str.internal_error:_entered_unreachable_codel
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
push 0x540084
push 0x21
push str.assertion_failed:_self.height___0
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
push 0x5438b0
push 0x28
push str.internal_error:_entered_unreachable_codel
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
mov dword [esp + 0x18], 4
mov eax, 1
push dword [esp + 0x18]
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
push 0x5438b0
push 0x28
push str.internal_error:_entered_unreachable_codel
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
push 0x5438b0
push 0x28
push str.internal_error:_entered_unreachable_codel
call fcn.004dc340
add esp, 0xc
jmp 0x4a72c6
call sub.kernel32.dll_GetLastError
mov byte [esp + 0x3c], 0
mov dword [esp + 0x40], eax
lea esi, [esp + 0x3c]
lea eax, [esp + 0xe4]
mov dword [esp + 0x14c], 0x543150
mov dword [esp + 0x150], 1
mov dword [esp + 0x15c], 0
mov dword [esp + 0xe4], esi
mov dword [esp + 0x154], eax
mov dword [esp + 0xe8], 0x488d10
mov dword [esp + 0x158], 1
lea eax, [esp + 0x14c]
push 0x543158
push eax
call fcn.004dc2b0
add esp, 8
jmp 0x4a72c6
xor eax, eax
jmp 0x4a71a5
push 0x5438a0
push eax
push ebx
call fcn.004e1cd0
add esp, 0xc
jmp 0x4a72c6
push 0x5438a0
push eax
push edi
call fcn.004e1cd0
add esp, 0xc
jmp 0x4a72c6
xor eax, eax
push esi
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
mov eax, 2
push esi
push eax
call fcn.004d09f0
add esp, 8
jmp 0x4a72c6
push 0x5438a0
push ecx
push eax
call fcn.004e1cd0
add esp, 0xc
jmp 0x4a72c6
push 0x5438a0
push eax
push ebx
call fcn.004e1cd0
add esp, 0xc
ud2