Function at 0x4482c6
Capabilities:
Delete registry key
Get disk information
Get file system object information
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b8
and dword [esp + 0x18], 0
push esi
push edi
mov esi, edx
mov dword [esp + 0x3c], ecx
push 2
lea ecx, [esp + 0xb4]
mov dword [esp + 0x5c], esi
call fcn.00416ef7
mov dword [esp + 0x10], 1
xor eax, eax
mov dword [esp + 0x1c], 0xbc99
mov dword [esp + 8], eax
jmp 0x44831c
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0xd4], 0x24a8
inc dword [esp + 8]
cmp dword [esp + 8], 3
jl 0x448309
mov dword [esp + 8], eax
jmp 0x44833f
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xb0]
mov dword [ecx + edx*4], 0x6ce125d1
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x448329
mov edi, dword [esp + 0xb0]
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
inc dword [edi + 4]
cmp dword [edi + 4], 3
mov dword [esp + ecx*4 + 0xd4], eax
jl 0x448350
push 0xfffffffffffffffd
mov dword [esp + 0x14], 0x19
pop ecx
cmp dword [esp + 0x10], ecx
jl 0x448496
mov dword [esp + 8], 4
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], ecx
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], ecx
mov ecx, dword [esp + 8]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
imul ecx, dword [esp + 8]
imul edx, ecx, 0xde46
mov ecx, dword [esp + 0xb0]
cmp edx, dword [ecx]
jne 0x4483c8
cmp dword [esp + 8], eax
je 0x4483c8
xor ecx, ecx
inc ecx
jmp 0x4483ca
mov ecx, eax
add ecx, dword [edi + 4]
cmp ecx, dword [edi + 4]
push 0
pop ecx
setle cl
sub ecx, 0x54981c58
neg ecx
push 0
sbb ecx, ecx
add ecx, 0x43dc315f
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x1c], ecx
setg dl
sub edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
xor edx, edx
cmp dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
setge dl
cmp ecx, edx
mov ecx, dword [esp + 0xc]
pop edx
setg dl
cmp edx, ecx
mov ecx, dword [esp + 0xd8]
push 0
pop edx
setle dl
imul ecx, dword [esp + 0xd4]
cmp ecx, edx
jge 0x448450
cmp dword [esp + 8], eax
je 0x448450
xor edx, edx
inc edx
jmp 0x448452
mov edx, eax
mov ecx, dword [esp + 8]
imul ecx, edx
xor edx, edx
push 0xfffffffffffffffd
cmp ecx, 0xae45
setg dl
lea esi, [edx - 0x264d9248]
xor edx, edx
imul esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
cmp esi, ecx
pop ecx
setl dl
mov dword [esp + 0x14c], edx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jge 0x448378
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0xb0]
call fcn.00417267
push dword [esp + 0x20]
movdqa xmm0, xmmword [0xaaf870]
lea ecx, [esp + 0x184]
push ecx
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x178]
mov dword [esp + 0xac], eax
push ecx
push eax
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb8], eax
movdqu xmmword [esp + 0x180], xmm0
mov dword [esp + 0xbc], eax
call fcn.0041793d
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x44850c
push 0
push 0x1225
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [esp + 0x10], 0xffffffec
jmp 0x448555
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], 0
jl 0x448551
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x44854b
push 0
push 0x3ff
push 0x108c
call dword [sym.imp.GDI32.dll_CreatePen]
dec dword [esp + 0x14]
jns 0x44852d
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe2
jg 0x448516
lea ecx, [esp + 0xa4]
call fcn.00417267
mov eax, dword [0x2ab4b20]
xor edi, edi
inc edi
test al, 1
jne 0x4485f8
or eax, edi
mov dword [0x2ab4b20], eax
xor eax, eax
push eax
push eax
mov dword [0x2ab4ae0], eax
mov dword [0x2ab4ae4], eax
call fcn.004399e4
mov ecx, eax
mov dword [0x2ab4afc], 0x3f800000
mov dword [0x2ab4ae0], ecx
xor eax, eax
mov dword [esp + 0xa0], ecx
lea ecx, [esp + 0xa0]
push ecx
push 0x10
push eax
mov dword [0x2ab4ae8], eax
mov ecx, 0x2ab4ae8
mov dword [0x2ab4af0], eax
mov dword [0x2ab4aec], eax
lea eax, [esp + 0x174]
push eax
call fcn.00439789
push 0x4b8371
mov dword [0x2ab4af4], 7
mov dword [0x2ab4af8], 8
call fcn.00498e6f
pop ecx
mov dword [esp + 8], edi
xor eax, eax
mov dword [esp + 0x20], 0x8f3c34ee
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 8], 0xf
jmp 0x44864c
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x44863d
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x180], 0x68c0aa39
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x44862a
inc dword [esp + 0x1c]
inc dword [esp + 8]
cmp dword [esp + 8], 0x14
jg 0x44861c
imul ecx, dword [esp + 0x3c], 0x2710
add ecx, esi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
cmp dword [esp + 0x128], eax
je 0x4486d7
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xa6e6f7fb
mov dword [esp + 0x10], 0xffffffe4
jmp 0x4486b8
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x16
jne 0x4486a4
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x44873a
push eax
push 0x181f
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x44873a
push 4
lea ecx, [esp + 0x114]
call fcn.00416ef7
mov dword [esp + 0x10], 0
jmp 0x448701
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x4486ef
mov eax, dword [esp + 0x110]
mov dword [eax + 0xc], 0x15
mov dword [esp + 0x18], 0x249a
cmp dword [esp + 0x18], 0
jne 0x44872e
dec dword [eax + 0xc]
cmp dword [eax + 0xc], 0xe
jne 0x448716
lea ecx, [esp + 0x110]
call fcn.00417267
lea eax, [esp + 0x5c]
push eax
call fcn.00449742
push 3
lea ecx, [esp + 0x44]
mov esi, dword [eax]
mov dword [esp + 0x28], esi
call fcn.00416ef7
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0x18], 0x11f64db2
mov dword [esp + 0x10], 0
jmp 0x448782
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x44876f
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x4487ac
push 0
push 0x175
push 0x22d4
push 0xd9e
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [esp + 8], 2
cmp dword [esp + 8], 0
jl 0x4489c3
push edi
lea ecx, [esp + 0x50]
call fcn.00416ef7
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4487e4
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x4c]
mov dword [ecx + edx*4], 0xf72d4ea6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4487d1
mov ecx, dword [esp + 0x4c]
mov dword [ecx], 2
mov dword [esp + 0x10], eax
jmp 0x448806
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x28], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4487fa
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x448821
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor eax, eax
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 2
jg 0x448900
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x40]
sub edx, dword [ecx + esi*4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0x40]
add esi, edx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
imul esi, dword [edi + ecx*4]
xor ecx, ecx
mov edx, dword [edx + 8]
cmp esi, 9
setl cl
sub edx, ecx
mov ecx, dword [esp + 0x4c]
sub edx, dword [ecx]
mov ecx, dword [esp + 0x2c]
cmp edx, dword [edi + ecx*4]
jg 0x4488a0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
cmp dword [ecx + edx*4], eax
jne 0x4488a0
mov esi, eax
jmp 0x4488a3
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x2c], edx
xor edx, edx
push 9
cmp esi, dword [edi + ecx*4]
pop ecx
setge dl
cmp ecx, edx
mov ecx, dword [esp + 0x18]
sbb esi, esi
xor edx, edx
neg esi
add esi, dword [edi + ecx*4]
mov ecx, dword [esp + 0x28]
cmp esi, ecx
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x2c]
setl dl
mov dword [ecx + esi*4], edx
mov ecx, dword [esp + 0x4c]
cmp dword [ecx], eax
jne 0x448904
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x448838
mov ecx, dword [esp + 0x4c]
dec dword [ecx]
push 1
pop edi
jns 0x4487f4
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 8]
mov edi, dword [esp + 8]
push 0
mov ecx, dword [ecx + edx*4]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x20], edi
cmp ecx, dword [edx]
pop ecx
setne cl
mov dword [edx], ecx
add ecx, 0xffff2946
mov edx, dword [esp + 8]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x2c], edx
xor edx, edx
cmp ecx, dword [edi + esi*4]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x1c]
setg dl
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp dword [esi + edi*4], ecx
mov edi, dword [esp + 0x2c]
sete dl
xor ecx, ecx
cmp edx, dword [esi + edi*4]
setge cl
cmp ecx, dword [esi]
je 0x448989
mov ecx, dword [esp + 0x4c]
cmp dword [ecx], eax
jne 0x448989
xor edi, edi
mov esi, eax
inc edi
jmp 0x44898e
xor edi, edi
inc edi
mov esi, edi
mov eax, dword [esp + 8]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
sub eax, esi
add eax, 0x1f0ef2ed
imul eax, dword [ecx + edx*4]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], eax
call fcn.00417267
dec dword [esp + 8]
jns 0x4487bf
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x40]
call fcn.00417267
test esi, esi
je 0x4489d9
mov dword [esp + 0x78], esi
jmp 0x449668
mov eax, dword [0x2ab4b20]
test al, 2
jne 0x448a67
or eax, 2
mov dword [0x2ab4b20], eax
xor eax, eax
push eax
push eax
mov dword [0x2ab4b00], eax
mov dword [0x2ab4b04], eax
call fcn.004399e4
mov ecx, eax
mov dword [0x2ab4b1c], 0x3f800000
mov dword [0x2ab4b00], ecx
xor eax, eax
mov dword [esp + 0x84], ecx
lea ecx, [esp + 0x84]
push ecx
push 0x10
push eax
mov dword [0x2ab4b08], eax
mov ecx, 0x2ab4b08
mov dword [0x2ab4b10], eax
mov dword [0x2ab4b0c], eax
lea eax, [esp + 0x170]
push eax
call fcn.00439789
push 0x4b836c
mov dword [0x2ab4b14], 7
mov dword [0x2ab4b18], 8
call fcn.00498e6f
pop ecx
xor eax, eax
mov dword [esp + 8], 5
push 3
mov dword [esp + 0x14], eax
pop edx
jmp 0x448a89
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x188], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x448a7a
mov dword [esp + 8], 2
cmp dword [esp + 8], eax
jl 0x448ae8
mov dword [esp + 0x10], 0xede0b407
mov dword [esp + 0x10], eax
jmp 0x448adb
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x448ad7
push 0x10c7
push 0x9e0
push 0x21e3
push 0x782
push 0x1b8a
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x448aab
dec dword [esp + 8]
jns 0x448a9d
mov dword [esp + 8], 7
xorps xmm0, xmm0
movdqu xmmword [esp + 0x88], xmm0
mov dword [esp + 8], 0x7e2799ac
mov dword [esp + 0x1c], 0x8872fa4
mov dword [esp + 8], eax
jmp 0x448b63
mov dword [esp + 0x18], 0x4d2edc75
mov dword [esp + 0x10], 0xffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], eax
jmp 0x448b58
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x448b54
push 0x24f3
push 0x24c5
push eax
push 0x1817
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1f
jl 0x448b30
inc dword [esp + 8]
cmp dword [esp + 8], 0xa
jge 0x448b12
dec dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
call fcn.004497a4
mov edi, dword [eax]
xor eax, eax
mov dword [esp + 8], 0x82062403
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 8], eax
jmp 0x448d3c
mov dword [esp + 0x20], 0x60d2f38
xor edx, edx
mov dword [esp + 0x30], 5
inc edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], 0xa277ebd0
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0xac77
mov dword [esp + 0x14], eax
jmp 0x448bf2
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x34], 0x9ab5c294
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x448be2
mov ecx, dword [esp + 8]
inc dword [esp + 0x24]
je 0x448c3e
mov ecx, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
setg dl
mov dword [esp + 0x60], edx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x6c]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setg dl
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 8]
mov dword [esp + 0x14], 0x25f8
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x14], ecx
jl 0x448cfe
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 0x90c37c50
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x14]
test ecx, ecx
je 0x448cda
cmp dword [esp + 0x64], eax
je 0x448cda
xor esi, esi
inc esi
jmp 0x448cdc
mov esi, eax
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x10]
sete dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
setge dl
mov dword [esp + 0x10], edx
jmp 0x448d38
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x68], ecx
cmp dword [esp + 0x2c], eax
jne 0x448d47
dec dword [esp + 8]
cmp dword [esp + 8], 0xfffffff1
jl 0x448bad
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x448d61
push 0xf0a
push 0x1023
call dword [sym.imp.GDI32.dll_RestoreDC]
mov al, byte [ebp + 0xc]
test al, al
jne 0x448d70
test edi, edi
jne 0x4490ad
lea ecx, [esp + 0x1a0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x40]
call fcn.0043a298
mov esi, eax
lea edi, [esp + 0x8c]
pop ecx
push 3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0xae97
xor esi, esi
inc dword [esp + 0xc]
inc esi
mov dword [esp + 0xc], 0
pop edi
cmp dword [esp + 8], 0x2a
jge 0x448e62
mov dword [esp + 0x24], 5
lea ecx, [esp + 0x11c]
push edi
call fcn.00416ef7
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x448de5
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x11c]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x448dd3
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x448dfd
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, esi
setle cl
sub ecx, dword [esp + 8]
mov eax, dword [esp + 0x11c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x11c]
call fcn.00417267
inc dword [esp + 8]
jmp 0x448dab
cmp byte [ebp + 0xc], 0
je 0x4490a9
cmp dword [esp + 0x90], 0
je 0x4490a9
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 0xa876e6ba
mov dword [esp + 0x20], 0x444696a4
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x20], 8
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0
jmp 0x448ec3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x194], 0xbeb7161a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x448eb0
dec dword [esp + 0x18]
lea ecx, [esp + 0xc8]
mov eax, dword [esp + 0x94]
mov dword [esp + 0x20], 0
push 2
mov dword [esp + 0x80], eax
call fcn.00416ef7
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x18], 0xbc99
mov dword [esp + 8], eax
jmp 0x448f18
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x104], 0x24a8
inc dword [esp + 8]
cmp dword [esp + 8], edi
jl 0x448f05
mov dword [esp + 8], eax
jmp 0x448f3a
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc8]
mov dword [ecx + edx*4], 0x6ce125d1
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x448f24
mov edi, dword [esp + 0xc8]
mov dword [edi + 4], eax
mov ecx, dword [edi + 4]
inc dword [edi + 4]
cmp dword [edi + 4], 3
mov dword [esp + ecx*4 + 0x104], eax
jl 0x448f4b
push 0xfffffffffffffffd
mov dword [esp + 0x14], 0x19
pop ecx
cmp dword [esp + 0x10], ecx
jl 0x44908f
jmp 0x448f78
xor esi, esi
inc esi
mov dword [esp + 8], 4
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], ecx
mov ecx, dword [esp + 8]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
imul ecx, dword [esp + 8]
imul edx, ecx, 0xde46
mov ecx, dword [esp + 0xc8]
cmp edx, dword [ecx]
jne 0x448fc5
mov ecx, esi
cmp dword [esp + 8], eax
jne 0x448fc7
mov ecx, eax
add ecx, dword [edi + 4]
cmp ecx, dword [edi + 4]
push 0
pop ecx
setle cl
sub ecx, 0x54981c58
neg ecx
push 0
sbb ecx, ecx
add ecx, 0x43dc315f
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x24], ecx
setg dl
sub edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
xor edx, edx
cmp dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
setge dl
cmp ecx, edx
mov ecx, dword [esp + 0xc]
pop edx
setg dl
cmp edx, ecx
mov ecx, dword [esp + 0x108]
push 0
pop edx
setle dl
imul ecx, dword [esp + 0x104]
cmp ecx, edx
jge 0x44904d
cmp dword [esp + 8], eax
je 0x44904d
xor edx, edx
inc edx
jmp 0x44904f
mov edx, eax
mov ecx, dword [esp + 8]
imul ecx, edx
xor edx, edx
push 0xfffffffffffffffd
cmp ecx, 0xae45
setg dl
lea esi, [edx - 0x264d9248]
xor edx, edx
imul esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
cmp esi, ecx
pop ecx
setl dl
mov dword [esp + 0x13c], edx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jge 0x448f75
lea ecx, [esp + 0xc8]
call fcn.00417267
mov eax, dword [esp + 0x90]
mov dword [esp + 0x80], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x14], 0
jmp 0x4490d2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b0], 0x82062403
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4490bf
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], 0
jl 0x449100
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x4490fa
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
dec dword [esp + 0x10]
jns 0x4490e8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
test edi, edi
jne 0x4494cc
cmp dword [esp + 0x88], edi
jle 0x4494cc
mov dword [esp + 0x18], 0x2263126f
mov dword [esp + 0x2c], 0x18e9
mov dword [esp + 0x1c], 0x89bdd777
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 0x5ab4d258
mov dword [esp + 0x14], edi
jmp 0x44915b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x44914b
mov eax, dword [esp + 0x18]
xor esi, esi
mov eax, dword [esp + 0x2c]
inc esi
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x74], esi
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub edx, eax
mov dword [esp + 0x74], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
setle cl
sub edx, ecx
lea ecx, [esp + 0xec]
neg edx
push 2
sbb edx, edx
inc eax
inc edx
add eax, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x5546
mov dword [esp + 0x1c], esi
call fcn.00416ef7
push 3
pop esi
mov dword [esp + 0x18], 0x1162f630
lea ecx, [esp + 0xf8]
push esi
call fcn.00416ef7
xor eax, eax
mov dword [esp + 0x20], 0x21c9b6cd
mov dword [esp + 8], eax
jmp 0x449209
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x98], 0xfffd
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x4491f6
mov dword [esp + 8], eax
jmp 0x44922c
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xec]
mov dword [ecx + edx*4], 0x27359b50
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x449216
mov dword [esp + 8], eax
jmp 0x44924f
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xf8]
mov dword [ecx + edx*4], 0xabb75da2
inc dword [esp + 8]
cmp dword [esp + 8], esi
jl 0x449239
or edx, 0xffffffff
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
sub edx, ecx
add edx, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, 0x4c38b6b0
mov edx, 0xdc2a82a1
push 0
setg cl
sub edx, ecx
mov ecx, dword [esp + 0xf0]
cmp edx, dword [ecx]
pop ecx
setne cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], eax
je 0x449295
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
dec dword [esp + 0x98]
mov eax, dword [esp + 0xf8]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
lea eax, [eax + ecx*2]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0xf8]
call fcn.00417267
lea ecx, [esp + 0xec]
call fcn.00417267
xor edx, edx
mov dword [esp + 0x24], 0x5c8094a
inc edx
xor eax, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0x6f6dd8d1
mov dword [esp + 0x14], eax
jmp 0x449301
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x16c], 0x9b31
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x4492ee
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
jl 0x449360
push esi
lea ecx, [esp + 0xe4]
call fcn.00416ef7
mov dword [esp + 0x14], 0
jmp 0x44933b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe0]
and dword [eax + ecx*4], 0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x449328
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0xe0]
inc dword [eax + 4]
call fcn.00417267
dec dword [esp + 0x24]
jns 0x449311
xor edx, edx
inc edx
mov esi, dword [esp + 0x8c]
test esi, esi
je 0x4494cc
push edx
push 0x331
push edx
push 0x2793
push 0x3826
push 0x52f2
push esi
push edx
call fcn.00447045
push esi
call fcn.004626ca
add esp, 0x24
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 8], 0
lea ecx, [esp + 0x158]
mov edi, eax
push 2
call fcn.00416ef7
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 2
jge 0x4493e5
push dword [esp + 0x14]
lea ecx, [esp + 0x15c]
call fcn.00416f95
mov dword [eax], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4493c2
xor eax, eax
mov dword [esp + 0x10], 0xfffffff4
jmp 0x4494a9
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ecx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x1c]
add edx, 0xf737
cmp ecx, edx
push 0
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
cmp ecx, 0xcc2fdcb
mov ecx, dword [esp + 0x20]
setle dl
sub ecx, edx
je 0x449468
cmp dword [esp + 0x1c], eax
jne 0x4494b4
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4494a5
push 0x30a
push eax
push 0xa80
push 0x158
push eax
push 0x22c9
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
xor eax, eax
jmp 0x4494a5
mov dword [esp + 0x18], 0x4ba8b35e
mov dword [esp + 8], eax
jmp 0x449498
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x44948e
push 0x232c
call dword [sym.imp.GDI32.dll_GetStockObject]
xor eax, eax
cmp dword [esp + 0x18], eax
jne 0x4494b4
inc dword [esp + 8]
cmp dword [esp + 8], 1
jle 0x449476
cmp dword [esp + 0x18], eax
jne 0x4494b4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffa
je 0x4493f2
lea ecx, [esp + 0x158]
call fcn.00416f90
lea eax, [esp + 0x3c]
push eax
call fcn.004497a4
mov dword [eax], edi
mov dword [esp + 0x10], 4
mov dword [esp + 0x20], 0x2466e9f0
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x4494f0
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esp + 0x10], 0
jmp 0x4495c5
push 3
lea ecx, [esp + 0xc0]
call fcn.00416ef7
mov dword [esp + 0x18], 0x8cf4c59c
mov dword [esp + 0x1c], 0x7f4ea14c
mov dword [esp + 0x18], 0xe13f5e3
mov dword [esp + 0x14], 0
jmp 0x449547
push dword [esp + 0x14]
lea ecx, [esp + 0xc0]
call fcn.00416f95
mov dword [eax], 0x64dc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x44952d
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x449564
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [esp + 0x10]
xor esi, esi
mov eax, dword [esp + 0x20]
inc esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], esi
jne 0x44958d
push esi
lea ecx, [esp + 0xc0]
call fcn.00416f95
cmp dword [eax], 0
jne 0x44958d
xor esi, esi
push 1
lea ecx, [esp + 0xc0]
call fcn.00416f95
xor edx, edx
cmp dword [eax], esi
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xbc]
call fcn.00416f90
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffa
jg 0x4494fd
lea ecx, [esp + 0x88]
call fcn.00442f78
mov dword [esp + 0x10], 0x13dd33a4
mov dword [esp + 0x10], 0xffffffe3
jmp 0x449640
mov dword [esp + 0x14], 1
mov dword [esp + 0x14], 0xfffffff3
jmp 0x449635
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x44961d
push 0
push 0
push 0
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x449631
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffed
jl 0x449600
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff9
jle 0x4495ee
test edi, edi
je 0x449668
mov edx, dword [esp + 0x58]
mov ecx, edi
call fcn.004482bc
mov esi, eax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x7c], esi
call fcn.00449742
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x78]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret