Function at 0x462150
Capabilities:
Encode data using base64
Get disk information
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x3bc
push ebx
push esi
lea eax, [ebp + 0x78]
push edi
push eax
mov dword [ebp - 0xb8], ecx
call fcn.0043dae7
pop ecx
push 5
lea ecx, [ebp + 0xc]
call fcn.00443f79
push 0x14
lea ecx, [ebp - 0x1cc]
call fcn.00443f79
lea ecx, [ebp - 0xcc]
call fcn.00443f5b
lea ecx, [ebp - 0xbc]
call fcn.00443f5b
lea ecx, [ebp - 0xc0]
call fcn.00443f5b
mov eax, dword [ebp + 0x78]
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 0x34], eax
push 0x2c
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp + 4], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0x14], 0xfffc0000
mov dword [ebp + 0x60], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x58], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x75], bl
mov byte [ebp - 0x7d], bl
mov byte [ebp + 0x5e], bl
mov byte [ebp + 0x4b], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0xa2], bl
mov byte [ebp - 0x2a], bl
mov dword [ebp - 0x84], ebx
call fcn.00446d58
mov eax, dword [ebp - 0xbc]
mov word [eax], bx
mov eax, dword [ebp - 0x34]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x462292
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x34], eax
push 0x2c
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00446d58
add esp, 0xc
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
mov byte [ebp + 0x1e], 0
mov byte [ebp + 0x66], 0
mov byte [ebp - 0x95], 0xff
mov byte [ebp + 0xb], 0
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x7e], 0
mov byte [ebp + 0x1c], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x26], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x64], 0
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x28], 0xff
mov byte [ebp + 3], 0xff
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x88], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x5c], 0
mov byte [ebp + 2], 0
mov dword [ebp - 0x60], 0xfffff000
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x64], esi
je 0x462ca2
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c654c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x46233a
or byte [ebp + 0x1e], 1
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c6544
call fcn.00445f31
add esp, 0xc
test al, al
je 0x46235a
or byte [ebp + 0x1e], 2
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c653c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x46237d
or byte [ebp - 0x11e], 1
jmp 0x462c1e
push 7
lea eax, [ebp + 0x78]
push eax
push 0x4c6534
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4623a0
or byte [ebp - 0x11e], 2
jmp 0x462c1e
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c1aec
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x462c50
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c652c
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c6524
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4623f6
or dword [ebp - 0x18], 1
jmp 0x462c1e
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c651c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462418
or dword [ebp - 0x18], 2
jmp 0x462c1e
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c6514
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462438
or dword [ebp - 0x18], 0x10
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c650c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462457
or dword [ebp - 0x18], 8
jmp 0x462c1e
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c6504
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462476
or dword [ebp - 0x18], edi
jmp 0x462c1e
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c6500
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462496
mov byte [ebp + 0x26], 1
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64f8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4624b5
mov byte [ebp + 0x5f], 1
jmp 0x462c1e
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c64f0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4624d5
mov byte [ebp + 0x5f], 0x21
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64e8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4624f4
mov byte [ebp + 0x65], 1
jmp 0x462c1e
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c64e0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462514
mov byte [ebp + 0x65], 0x21
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64d8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462533
mov byte [ebp + 0x64], 1
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64cc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462552
mov byte [ebp + 0x64], 2
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64c4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462571
mov byte [ebp + 0x64], 4
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64bc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462590
mov byte [ebp - 0x7d], 1
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c5cb4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4625af
mov byte [ebp - 0x49], 1
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c1a94
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4625cf
mov byte [ebp - 0x75], 1
jmp 0x462c1e
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c64b8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4625f2
mov byte [ebp - 0xa2], 1
jmp 0x462c1e
push 2
lea eax, [ebp + 0x78]
push eax
push 0x4c5c64
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462618
add dword [ebp - 0x88], 0x100
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c64b0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462637
mov byte [ebp - 0x2a], 1
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c64a8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462657
or byte [ebp - 0x26], 0x40
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c64a0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462677
mov byte [ebp + 0x4b], 3
jmp 0x462c1e
mov edi, dword [ebp + 0x78]
push 7
push edi
push 0x4c6498
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462696
inc edi
mov byte [ebp + 0x4b], 3
inc edi
jmp 0x4626ae
push 6
push edi
push 0x4c6490
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462716
mov byte [ebp + 0x4b], 1
add edi, 0xc
xor ecx, ecx
mov dword [ebp + 0x78], edi
mov cx, word [edi]
cmp cx, bx
je 0x4626e7
mov eax, ecx
call fcn.0043daaf
test al, al
jne 0x4626e7
push ecx
call fcn.004439f7
add esp, 4
test al, al
jne 0x4626e7
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 4], edi
call fcn.00405615
jmp 0x462849
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0040567a
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0040567a
add esp, 0x10
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
pop ecx
jmp 0x462c1e
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c6488
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462736
mov byte [ebp + 0x4b], 1
jmp 0x462c1e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c6480
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x46266e
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c6478
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462777
mov byte [ebp + 0x4b], 0xf0
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
jmp 0x462c1e
mov edi, dword [ebp + 0x78]
push 4
push edi
push 0x4c6470
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x4627d9
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x4627aa
cmp ax, 0x3d
je 0x4627aa
call fcn.0043daaf
test al, al
je 0x4627d9
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
mov dword [ebp - 0xb4], ebx
je 0x4627c5
mov dword [ebp - 8], 0x4c6468
jmp 0x462707
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x46283f
push 4
push edi
push 0x4c6460
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462862
lea ecx, [edi + 8]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x462809
cmp ax, 0x3d
je 0x462809
call fcn.0043daaf
test al, al
je 0x462862
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
lea eax, [ebp + 0x78]
mov dword [ebp - 8], ebx
push eax
je 0x46282e
mov dword [ebp - 0xb4], 0x4bd7b2
call fcn.00405615
pop ecx
jmp 0x462707
add dword [ebp + 0x78], 2
call fcn.0043dae7
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00405615
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x462707
mov word [eax], bx
add dword [ebp + 0x78], 2
jmp 0x462707
push 9
push edi
push 0x4c6454
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x4628e9
lea ecx, [edi + 0x12]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x462892
cmp ax, 0x3d
je 0x462892
call fcn.0043daaf
test al, al
je 0x4628e9
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x3d
jne 0x4628da
xor eax, eax
add ecx, 2
mov ax, word [ecx]
push eax
call fcn.004439f7
add esp, 4
test al, al
je 0x462c02
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x30], ecx
call fcn.00448ed1
cmp dword [ebp - 0x70], ebx
pop ecx
pop ecx
jg 0x462c02
jl 0x4628da
cmp dword [ebp - 0x74], ebx
ja 0x462c02
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x70], esi
jmp 0x462c02
push 6
push edi
push 0x4c644c
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462997
lea ecx, [edi + 0xc]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x46291d
cmp ax, 0x3d
je 0x46291d
call fcn.0043daaf
test al, al
je 0x462997
lea eax, [ebp + 0x78]
mov edi, ecx
push eax
mov dword [ebp + 0x78], edi
call fcn.00405615
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
cmp word [edi], 0x3d
pop ecx
pop ecx
je 0x46294d
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], esi
jmp 0x462c1e
xor eax, eax
lea ecx, [edi + 2]
mov ax, word [ecx]
push eax
call fcn.004439f7
add esp, 4
test al, al
je 0x462c1e
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x30], ecx
call fcn.00448ed1
cmp dword [ebp - 0x9c], ebx
pop ecx
pop ecx
jg 0x462c1e
jl 0x46293c
cmp dword [ebp - 0xa0], ebx
ja 0x462c1e
jmp 0x46293c
push 6
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c6444
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4629bc
mov byte [ebp - 0x95], 1
jmp 0x462c1e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c643c
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4629db
mov byte [ebp + 3], 1
jmp 0x462c1e
push 7
lea eax, [ebp + 0x78]
push eax
push 0x4c6434
call fcn.00445f31
add esp, 0xc
test al, al
je 0x4629fb
mov byte [ebp + 3], 0
jmp 0x462c1e
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c0318
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x462c1a
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c2000
call fcn.00445f31
add esp, 0xc
test al, al
jne 0x462c1a
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c5cdc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462a55
or dword [ebp - 0x18], 0x20
mov byte [ebp - 0x47], 1
jmp 0x462c1e
push edi
push dword [ebp + 0x78]
push 0x4c642c
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462a8e
add dword [ebp + 0x78], 0xc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004503bc
test eax, eax
pop ecx
pop ecx
jl 0x46447b
mov byte [ebp + 2], 1
jmp 0x462c1e
push 5
push dword [ebp + 0x78]
push 0x4c6424
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462b2d
add dword [ebp + 0x78], 0xa
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x1c], edi
call fcn.00408ddd
xor eax, eax
mov ax, word [edi]
push eax
call fcn.004439f7
add esp, 0xc
test al, al
je 0x462ae8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00448ed1
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x3a
jne 0x462b07
add dword [ebp - 0x1c], 2
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00448ed1
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x3a
jne 0x462c1e
add dword [ebp - 0x1c], 2
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00448ed1
jmp 0x462c14
push 5
push dword [ebp + 0x78]
push 0x4c641c
call fcn.0043eeea
add esp, 0xc
test al, al
jne 0x462c2a
push edi
push dword [ebp + 0x78]
push 0x4c6414
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462b8b
add dword [ebp + 0x78], 0xc
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp - 0x30], 0x42
call fcn.004503bc
mov al, byte [ebp - 0x30]
add esp, 0xc
mov byte [ebp - 0x5c], al
jmp 0x462c1e
push 4
push dword [ebp + 0x78]
push 0x4c640c
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x462bb4
add dword [ebp + 0x78], 8
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004503bc
jmp 0x462c14
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c6404
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462bd6
mov dword [ebp - 0x84], 8
jmp 0x462c1e
push 7
lea eax, [ebp + 0x78]
push eax
push 0x4c63fc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462bf9
mov dword [ebp - 0x84], 0x10
jmp 0x462c1e
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2d
jne 0x462c2a
lea eax, [ebp + 0x78]
push eax
call fcn.00405615
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
pop ecx
jmp 0x462710
mov byte [ebp + 0xb], 1
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
jne 0x46231a
cmp dword [ebp - 0x74], 0xfffffffe
jne 0x462c91
cmp dword [ebp - 0x70], esi
jne 0x462c91
mov eax, dword [ebp - 0xa0]
cmp eax, 0xfffffff7
jne 0x462c85
cmp dword [ebp - 0x9c], esi
jne 0x462c85
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
jmp 0x462ca2
push 0x4c63e4
lea ecx, [ebp - 0x5c]
call fcn.0044cd74
push dword [ebp + 0x78]
lea ecx, [ebp - 0x5c]
call fcn.00443fc7
push dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xb8]
call fcn.00422e2f
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.0043db4f
jmp 0x466bfb
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0xa0], 0xfffffff7
jne 0x462cb2
cmp dword [ebp - 0x9c], esi
jne 0x462cb2
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x9c], ebx
cmp dword [ebp - 0x74], 0xfffffff7
jne 0x462ccf
cmp dword [ebp - 0x70], esi
jne 0x462ccf
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x70], eax
push 4
pop edi
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c63dc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462ded
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c63d4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462d0b
mov byte [ebp + 0x66], 1
jmp 0x462ded
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c06ac
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462d2a
mov byte [ebp + 0x66], 2
jmp 0x462ded
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c63d0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462d4a
mov byte [ebp + 0x66], 3
jmp 0x462ded
push 5
lea eax, [ebp + 0x78]
push eax
push 0x4c63c8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462d71
mov byte [ebp + 0x66], 4
mov dword [ebp - 0x84], 8
jmp 0x462ded
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c63c0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462d98
mov byte [ebp + 0x66], 5
mov dword [ebp - 0x84], 0x10
jmp 0x462ded
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c63b8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462db5
mov byte [ebp + 0x66], 6
jmp 0x462ded
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c63b0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462dd2
mov byte [ebp + 0x66], 7
jmp 0x462ded
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c63ac
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462ded
mov byte [ebp + 0x66], 8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c5fd4
mov byte [ebp + 0x27], 0
call fcn.00445f31
xor edi, edi
add esp, 0xc
inc edi
test al, al
je 0x462e11
mov byte [ebp + 0x5e], 1
mov dword [ebp + 0x60], edi
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4c63a8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462e2c
mov byte [ebp + 0x5e], 0x10
push 6
lea eax, [ebp + 0x78]
push eax
push 0x4c63a0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462e49
mov byte [ebp + 0x27], 1
jmp 0x462e9e
push 7
lea eax, [ebp + 0x78]
push eax
push 0x4c6398
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462e66
mov byte [ebp + 0x27], 0x20
jmp 0x462e9e
push 7
lea eax, [ebp + 0x78]
push eax
push 0x4c6390
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462e83
mov byte [ebp + 0x27], 0x10
jmp 0x462e9e
push 8
lea eax, [ebp + 0x78]
push eax
push 0x4c6384
call fcn.00445f31
add esp, 0xc
test al, al
je 0x462ea1
mov byte [ebp + 0x27], 0x18
mov dword [ebp + 0x60], edi
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.00405615
mov eax, dword [ebp + 0x78]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xcc]
call fcn.0044407f
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
pop ecx
mov ecx, dword [ebp + 0x78]
xor eax, eax
mov ax, word [ecx]
mov edx, eax
or edx, 0x20
cmp dx, 0x61
jne 0x462eeb
mov dword [ebp - 0xa8], 0x80
jmp 0x462f05
cmp ax, 0x2d
jne 0x462f0f
mov ax, word [ecx + 2]
or ax, 0x20
cmp ax, 0x61
jne 0x462f0f
mov dword [ebp - 0xa8], ebx
lea eax, [ebp + 0x78]
push eax
call fcn.00405615
pop ecx
xor eax, eax
mov dword [ebp - 0x214], ebx
lea edi, [ebp - 0x210]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x4d88b0
push edi
mov dword [ebp - 0x1c0], 0xebd0a0a2
mov word [ebp - 0x1bc], 0xb9e5
mov word [ebp - 0x1ba], 0x4433
mov byte [ebp - 0x1b8], 0x87
mov byte [ebp - 0x1b7], 0xc0
mov byte [ebp - 0x1b6], 0x68
mov byte [ebp - 0x1b5], 0xb6
mov byte [ebp - 0x1b4], 0xb7
mov byte [ebp - 0x1b3], 0x26
mov byte [ebp - 0x1b2], 0x99
mov byte [ebp - 0x1b1], 0xc7
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x30], 0x4c6368
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x180], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp byte [ebp + 0x64], 0
jne 0x462ff5
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004503bc
pop ecx
pop ecx
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2d
jne 0x463024
xor eax, eax
lea edx, [ecx + 2]
mov ax, word [edx]
push eax
call fcn.004439f7
add esp, 4
test al, al
jne 0x463024
mov ecx, edx
mov byte [ebp - 0x7e], 1
mov dword [ebp + 0x78], ecx
jmp 0x463024
push ebx
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0045247f
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x174], eax
jne 0x463021
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor esi, esi
jmp 0x466bfb
mov ecx, dword [ebp + 0x78]
cmp word [ecx], 0x2b
jne 0x463034
mov al, byte [ecx]
inc ecx
inc ecx
mov byte [ebp - 0x46], al
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2d
jne 0x463045
lea eax, [ebp + 0x78]
push eax
call fcn.00408ddd
jmp 0x463059
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00448f81
pop ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
mov byte [ebp - 0x1e], 1
jne 0x463070
inc eax
inc eax
mov dword [ebp + 0x78], eax
mov byte [ebp - 0x1e], 0
cmp word [eax], 0x2d
jne 0x463081
lea eax, [ebp + 0x78]
push eax
call fcn.00408ddd
jmp 0x463095
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00448f81
pop ecx
mov dword [ebp - 0x180], eax
cmp byte [ebp + 0x64], 0
pop ecx
je 0x4630cc
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0045247f
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00448ed1
add esp, 0x14
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x1c4], ebx
mov cx, word [eax]
cmp cx, 0x2d
je 0x463123
cmp byte [ebp + 0x64], 0
je 0x463123
cmp cx, bx
je 0x463123
mov dword [ebp - 0x1c8], eax
push ebx
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.00419ccc
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x1c4]
add esp, 0xc
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x30], eax
mov word [eax + ecx*2], bx
cmp byte [ebp + 0x66], 1
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x48], 0
je 0x46313e
cmp byte [ebp + 0x66], 4
jge 0x46313e
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0xcc]
push 5
push ebx
mov edi, ebx
push 0x4c6360
mov dword [ebp + 0x78], edi
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x46321f
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x4631bf
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp + 0x34]
add ecx, 2
push eax
mov dword [ebp + 0x34], ecx
call fcn.00448f81
mov edi, dword [ebp + 0x34]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x48], 1
jne 0x4631ba
lea eax, [ebp - 0xe4]
push eax
inc edi
lea eax, [ebp + 0x34]
inc edi
push eax
mov dword [ebp + 0x34], edi
call fcn.00448f81
mov edi, dword [ebp + 0x34]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x48], 0x11
jne 0x4631ba
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x4631ef
cmp dx, 0x2f
je 0x4631ef
mov byte [ebp - 0x28], 1
jmp 0x4631ef
mov eax, edx
call fcn.0043daaf
test al, al
jne 0x4631f4
cmp dx, 0x23
je 0x4631f4
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x4631d6
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x463210
push ecx
push edi
lea ecx, [ebp - 0xc0]
call fcn.0044407f
mov dword [ebp - 0x14], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x46325f
push 2
push ebx
push 0x4c635c
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x463239
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00443b15
test al, al
je 0x463257
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004404ef
mov edi, dword [ebp + 0x78]
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x25]
push 0
push 0x200
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.004aa130
mov dword [ebp - 0x3c], eax
mov ax, word [edi]
cmp ax, 0x23
mov dword [ebp - 0x38], edx
je 0x463290
cmp ax, 0x3a
jne 0x46332f
inc edi
inc edi
push 2
push edi
push 0x4c6358
mov dword [ebp + 0x78], edi
call fcn.0043eeea
push 2
push edi
push 0x4c6354
mov byte [ebp + 0x67], al
call fcn.0043eeea
mov byte [ebp + 0x1c], al
mov al, byte [ebp + 0x67]
or al, byte [ebp + 0x1c]
add esp, 0x18
neg al
sbb al, al
inc al
cmp byte [ebp + 0x67], 0
mov byte [ebp - 0x1d], al
jne 0x4632dc
cmp word [edi], 0x2b
jne 0x4632dc
inc edi
inc edi
mov byte [ebp - 0x27], 1
mov dword [ebp + 0x78], edi
cmp byte [ebp + 0x1c], 0
jne 0x463300
mov ax, word [edi]
cmp ax, 0x40
je 0x4632f7
cmp ax, 0x2d
je 0x4632f7
cmp ax, 0x3d
jne 0x463300
or dword [ebp - 0x18], 2
inc edi
inc edi
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.00443b15
test al, al
je 0x46332f
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004503bc
test eax, eax
pop ecx
pop ecx
jle 0x46332f
cmp dword [ebp + 0x60], 0
mov byte [ebp - 0x29], 1
jne 0x463333
mov byte [ebp + 0x67], 1
jmp 0x463335
cmp dword [ebp + 0x60], 0
jg 0x463351
cmp byte [ebp + 0x66], 0
jg 0x463351
cmp dword [ebp - 8], 0
jne 0x463351
cmp dword [ebp - 0xb4], 0
jne 0x463351
xor ecx, ecx
mov dword [ebp + 0x40], ecx
jmp 0x46335a
mov dword [ebp + 0x40], 1
xor ecx, ecx
cmp byte [ebp + 0x4b], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
je 0x46337b
cmp dword [ebp + 0x40], ecx
jne 0x46337b
cmp word [ebx], cx
jne 0x46337b
mov eax, 0xfffc0000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc0]
lea edi, [ebp - 0x2cc]
mov word [ebp - 0x2cc], cx
cmp word [eax], cx
mov dword [ebp - 0xf8], edi
je 0x4633a1
mov edi, eax
mov dword [ebp - 0xf8], edi
push dword [ebp - 0x14]
lea eax, [ebp - 0x2cc]
push 0x4c57c8
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
cmp byte [ebp - 0x2a], 0
jg 0x4633f4
mov eax, dword [ebp - 0xb0]
or eax, dword [ebp - 0xac]
jne 0x4633f4
push 0x11
push edi
push 0x4c5150
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x4633f4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x30]
add edi, 0x22
push eax
mov dword [ebp + 0x30], edi
call fcn.004472d9
pop ecx
pop ecx
cmp byte [ebp + 0x27], 0
jne 0x463406
cmp byte [ebp + 0x5f], 0
jne 0x463406
cmp byte [ebp + 0x65], 0
je 0x46341c
cmp dword [ebp - 0x14], 0
jge 0x46341c
cmp dword [ebp - 0x24], 0
jge 0x46341c
push 0x4d88b0
jmp 0x464475
and dword [ebp + 0x6c], 0
and dword [ebp - 0x10], 0
cmp byte [ebp + 0x4b], 0
mov edi, 0x80070057
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x104], edi
mov byte [ebp + 0x68], 0
je 0x4634f5
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jge 0x46345d
cmp dword [ebp - 0x68], esi
jl 0x46345d
jg 0x463453
cmp dword [ebp - 0x6c], esi
jbe 0x46345d
cmp dword [ebp + 4], 0
je 0x4634f5
mov eax, dword [ebp + 4]
test eax, eax
je 0x463493
cmp word [eax], 0x2a
jne 0x463493
xor eax, eax
mov al, byte [ebp + 0x4b]
and eax, 2
shr eax, 1
push eax
push ebx
call fcn.00452655
pop ecx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x10], eax
xor eax, eax
or byte [0x4d8458], 0x20
pop ecx
mov byte [ebp + 0x68], 0x20
test ebx, ebx
jge 0x4634a7
cmp dword [ebp - 0x68], esi
jl 0x4634a7
jg 0x4634a3
cmp dword [ebp - 0x6c], esi
jbe 0x4634a7
test eax, eax
je 0x4634f5
push eax
xor eax, eax
mov al, byte [ebp + 0x4b]
and eax, 2
shr eax, 1
push eax
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push ebx
call fcn.004051f3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x68]
add esp, 0x1c
cmp eax, esi
je 0x4634ee
or byte [ebp + 0x68], 0x10
or byte [0x4d8458], 0x10
jmp 0x4634f5
mov byte [0x4d8458], 0
cmp byte [ebp + 2], 0
jbe 0x46374e
cmp byte [ebp + 0x64], 0
jne 0x46374e
xor esi, esi
cmp dword [ebp - 0x14], esi
jge 0x46351f
mov eax, dword [ebp - 0xc0]
cmp word [eax], si
je 0x46372c
mov eax, dword [ebp - 0x60]
cmp eax, esi
jle 0x46352f
cmp eax, dword [ebp + 0x60]
je 0x46372c
cmp dword [ebp + 0x60], 4
jg 0x46372c
cmp byte [ebp + 0x1e], 2
jl 0x46372c
push esi
push 0x20000000
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0xf8]
lea ecx, [ebp + 0x6c]
call fcn.0040569f
cmp dword [ebp + 0x6c], esi
je 0x463678
push 0x800
push 1
push esi
push dword [ebp + 0x6c]
call fcn.00448d1c
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x44], eax
call fcn.0044132f
add esp, 0x18
cmp eax, esi
mov ebx, eax
jge 0x463596
mov ebx, esi
lea eax, [ebx + ebx*2]
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp + 4], ebx
call fcn.00443e04
mov eax, dword [ebp + 0x34]
lea edi, [eax + ebx]
lea eax, [ebx - 1]
not eax
push 0
and edi, eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea esi, [edi + ebx]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4635f9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test esi, esi
jne 0x4635d7
inc esi
lea ecx, [ebp + 0x34]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
push 0x4d88b0
jmp 0x466bf5
push 0x200
push esi
push edi
call fcn.00413de4
dec dword [ebp - 0x60]
dec dword [ebp + 0x60]
mov ebx, dword [ebp - 0x60]
mov eax, dword [ebp + 0x60]
shl eax, 4
shl ebx, 4
push 0x10
lea ecx, [ebx + edi + 0x1be]
mov dword [ebp + 0x30], eax
push ecx
lea eax, [eax + esi + 0x1be]
push eax
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
call fcn.00413de4
mov eax, dword [ebp + 0x30]
lea eax, [eax + edi + 0x1be]
push 0x10
push eax
lea eax, [ebx + esi + 0x1be]
push eax
call fcn.00413de4
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x34
test eax, eax
je 0x46369b
lea ecx, [ebp + 0x34]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
push 0x4d88b0
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor esi, esi
inc esi
jmp 0x466bfb
push dword [ebp + 4]
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
call fcn.0044422d
add esp, 0xc
test eax, eax
jne 0x4636e0
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 4]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4636d7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x4636d4
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
push dword [ebp + 0x6c]
call fcn.0044193a
pop ecx
mov al, byte [ebp + 0x65]
or al, byte [ebp + 0x26]
lea ecx, [ebp + 0x34]
or byte [ebp + 0x5f], al
mov al, byte [ebp + 0x65]
or al, byte [ebp + 0x5f]
or al, byte [ebp + 0x26]
je 0x463704
mov dword [ebp + 0x40], ebx
call fcn.0043db4f
jmp 0x465c7a
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
push 0x4d88b0
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [ebp - 0x10]
jmp 0x466bfb
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
push 0x4d88b0
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, edi
jmp 0x466bfb
cmp byte [ebp + 0x27], 0x10
jne 0x463761
test byte [ebp + 0x65], 0x20
jne 0x465c7a
or esi, 0xffffffff
xor ebx, ebx
cmp byte [ebp + 0x4b], 0
mov ecx, dword [ebp + 0x60]
mov edi, dword [ebp - 0xcc]
je 0x4637c0
cmp dword [ebp + 0x40], ebx
jne 0x4637c0
cmp byte [ebp + 0x26], 0
jne 0x465c7a
cmp byte [ebp + 0x5f], 0
jne 0x465c7a
cmp byte [ebp + 0x65], 0
jne 0x465c7a
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
test eax, eax
je 0x4637b5
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [ebp - 0x104]
jmp 0x466bfb
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x465dec
cmp dword [ebp - 0xb4], ebx
jne 0x46612c
mov dl, byte [ebp + 0x66]
cmp dl, 6
mov dword [ebp - 0x10], 0x80070057
je 0x46654e
cmp dl, 1
je 0x466653
cmp dl, 2
jne 0x463802
cmp byte [ebp - 0x2a], 0
je 0x466696
cmp dl, 8
jne 0x463811
cmp byte [ebp - 0x2a], 0
je 0x4666d9
xor eax, eax
cmp dl, 3
mov dword [ebp + 0x58], eax
je 0x46676e
cmp dl, 4
je 0x466e66
cmp dl, 5
je 0x466e66
cmp dl, 7
je 0x466847
cmp byte [ebp + 0x1c], al
je 0x463857
push 5
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
pop ecx
cmp byte [ebp + 0x67], 0
mov dword [ebp - 0x10], ebx
je 0x463863
push 5
pop ecx
cmp byte [ebp + 0xb], 0
je 0x46387e
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
cmp byte [ebp - 0x25], 0
je 0x46388d
cmp dword [ebp - 0x24], ebx
jl 0x464453
cmp byte [ebp - 0x1d], 0
je 0x46389b
cmp ecx, ebx
jl 0x464453
dec ecx
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x60], ecx
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
mov byte [ebp + 0x1d], 0
mov byte [ebp - 0xa1], 0
mov dword [ebp + 0x30], ebx
mov byte [ebp + 2], 0
mov byte [ebp - 0x45], 0
mov dword [ebp - 0x7c], ebx
jne 0x4638ef
cmp dword [ebp - 0x58], ebx
jne 0x4638ef
mov eax, dword [ebp + 0x4c]
or eax, dword [ebp + 0x50]
jne 0x4638ef
mov eax, dword [ebp + 0x28]
or eax, dword [ebp + 0x2c]
jne 0x4638ef
mov byte [ebp + 0xb], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
cmp byte [ebp - 0xa2], 0
je 0x463921
cmp dword [ebp + 0x50], ebx
jl 0x463921
jg 0x46390b
cmp dword [ebp + 0x4c], ebx
jb 0x463921
cmp dword [ebp + 0x2c], ebx
jl 0x463921
jg 0x463918
cmp dword [ebp + 0x28], 1
jb 0x463921
mov dword [ebp + 4], 1
jmp 0x463924
mov dword [ebp + 4], ebx
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xf8]
lea ecx, [ebp + 0x6c]
call fcn.0040569f
cmp dword [ebp + 0x6c], ebx
je 0x4668e2
mov edi, 0x200
push edi
push dword [ebp + 0x6c]
call fcn.0044132f
pop ecx
cmp eax, edi
pop ecx
mov edi, eax
jge 0x463966
mov edi, 0x200
cmp dword [ebp + 4], ebx
mov dword [ebp + 0x20], edi
je 0x4639e6
cmp dword [ebp + 0x50], ebx
jl 0x4639ac
jg 0x46397a
cmp dword [ebp + 0x4c], ebx
jb 0x4639ac
push ebx
push 0x200
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
call fcn.004aa130
test byte [ebp + 0x68], 0x11
jne 0x4639ac
push ebx
push ebx
push ebx
lea ecx, [edi + edi*4]
shl ecx, 3
push ecx
push edx
push eax
push dword [ebp - 0x24]
call fcn.004051f3
add esp, 0x1c
or byte [ebp + 0x68], 1
cmp byte [ebp + 0x67], 0
jne 0x4639e6
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp + 0x4c]
mov ecx, dword [ebp - 0xac]
adc ecx, dword [ebp + 0x50]
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043cc2f
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00441980
mov dword [ebp - 0x104], ebx
push 0x800
push 1
push ebx
push dword [ebp + 0x6c]
call fcn.00448d1c
add esp, 0x10
cmp byte [ebp + 0x27], 0
mov dword [ebp - 0x44], eax
je 0x463a0a
mov dword [ebp + 0x40], ebx
jmp 0x465c72
cmp dword [ebp - 0x58], 0xff
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
jg 0x46690e
cmp byte [ebp + 0x67], 0
jne 0x463a6e
cmp dword [ebp + 0x60], ebx
jge 0x463a6e
cmp dword [ebp + 0x50], ebx
jg 0x46690e
jl 0x463a42
cmp dword [ebp + 0x4c], ebx
jae 0x46690e
cmp dword [ebp + 0x2c], ebx
jg 0x46690e
jl 0x463a56
cmp dword [ebp + 0x28], ebx
jae 0x46690e
cmp dword [ebp - 0x58], ebx
jge 0x46690e
mov dword [ebp - 0x58], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x50], esi
cmp byte [ebp + 0x67], 0
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x19c], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp + 0x34], eax
jne 0x463ab3
cmp byte [ebp + 0x1c], 0
jne 0x463ab3
cmp eax, 4
jl 0x4640e7
cmp byte [ebp + 0x64], 0
jne 0x4640e7
cmp byte [ebp + 0x5e], 0
jne 0x4640e7
cmp byte [ebp + 0x67], 0
je 0x463ad4
mov dword [ebp + 0x60], 4
cmp dword [ebp - 0x58], 5
je 0x464453
cmp dword [ebp - 0x58], 0xf
je 0x464453
push 0x100000
lea ecx, [ebp - 0x40]
mov dword [ebp + 0x40], ebx
call fcn.00443e04
lea eax, [ebp + 0x40]
push eax
push dword [ebp - 0x40]
push dword [ebp + 0x6c]
call fcn.0044170d
mov edx, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
cmp byte [ebp + 0x67], 0
mov edi, eax
jne 0x463b3c
cmp edx, ecx
jge 0x463b21
cmp ecx, 4
jge 0x463b82
cmp byte [ebp + 0x67], 0
jne 0x463b3c
cmp byte [ebp + 0x1c], 0
jne 0x463b3c
lea eax, [ecx + 1]
cmp eax, 4
mov byte [ebp + 0x3f], 0
jg 0x463b6e
dec eax
jmp 0x463b75
cmp byte [ebp + 0x1c], 0
mov byte [ebp + 0x3f], 1
jne 0x463b8a
cmp byte [ebp + 0x67], 0
je 0x463b8f
cmp dword [ebp - 0x58], ebx
jl 0x463b82
cmp word [ebp - 0xa8], bx
jle 0x463b66
mov dword [ebp - 0xa8], 0x80
jmp 0x463b8f
mov dword [ebp - 0xa8], ebx
jmp 0x463b8f
lea eax, [eax*4 - 0x10]
cmp eax, ebx
jle 0x463b82
cmp eax, edx
jl 0x463b8f
cmp ecx, 4
jle 0x463b8f
lea ecx, [ebp - 0x40]
jmp 0x46444e
cmp edx, 4
jle 0x463b82
cmp edx, 4
jle 0x463b9f
lea eax, [edx - 4]
and eax, 0xfffffffc
mov dword [ebp + 0x10], eax
jmp 0x463ba2
mov dword [ebp + 0x10], ebx
cmp byte [ebp + 0x3f], 0
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x34], esi
jne 0x463bc2
cmp ecx, 4
jl 0x463bbf
lea eax, [ecx*4 - 0x10]
mov dword [ebp + 0x10], eax
jmp 0x463bc2
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x44], esi
xor edx, edx
lea eax, [edi + 0x50]
mov cl, byte [eax]
cmp cl, 5
je 0x463bd6
cmp cl, 0xf
jne 0x463bd9
mov dword [ebp + 0x44], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x463bca
cmp byte [ebp + 0x3f], 0
je 0x463bef
cmp dword [ebp + 0x44], ebx
jl 0x463b82
mov eax, dword [ebp + 0x44]
lea eax, [eax + eax*8]
push 0
shl eax, 4
lea esi, [eax + edi + 0x30]
mov ebx, 0x200
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x8c], esi
push dword [esi + 8]
call fcn.004aa080
push 0
push ebx
push dword [esi + 0x14]
mov dword [ebp - 0xdc], eax
push dword [esi + 0x10]
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edx
call fcn.004aa080
mov ebx, eax
mov eax, dword [ebp + 0x10]
lea eax, [eax + eax*8]
shl eax, 4
cmp byte [ebp + 0x1c], 0
mov dword [ebp - 0x1e8], edx
lea esi, [eax + edi + 0x30]
je 0x463d42
mov eax, dword [ebp + 0x40]
xor esi, esi
cmp eax, 8
jne 0x463c72
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xd8]
jmp 0x463ce9
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + edi + 0x30]
lea eax, [edi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x463cc8
cmp cl, 0xf
je 0x463cc8
inc esi
add eax, 0x90
cmp esi, 4
jl 0x463c85
lea ecx, [ebp - 0x40]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
test eax, eax
jmp 0x464472
push 0
push 0x200
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.004aa080
mov ecx, eax
mov eax, dword [edi + 0x24]
xor edi, edi
sub ecx, eax
sbb edx, edi
test esi, esi
jl 0x463c9c
and dword [ebp - 0x244], 0
xor eax, eax
add ecx, dword [ebp - 0xb0]
lea edi, [ebp - 0x240]
adc edx, dword [ebp - 0xac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x244]
push eax
push edx
push ecx
push dword [ebp + 0x6c]
call fcn.00452355
and dword [ebp - 0x10], 0
add esp, 0x14
cmp byte [ebp + 0x65], 0
jne 0x463d36
cmp byte [ebp + 0x5f], 0
jne 0x463d36
cmp byte [ebp + 0x26], 0
je 0x466932
and dword [ebp + 0x40], 0
lea ecx, [ebp - 0x40]
jmp 0x465c6d
cmp dword [ebp + 0x40], 4
jg 0x463d50
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x38], eax
jmp 0x463d7b
xor edx, edx
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x463d61
cmp cl, 0xf
jne 0x463d64
mov dword [ebp + 0x38], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x463d55
cmp byte [ebp + 0x3f], 0
jne 0x463d7b
mov eax, dword [ebp + 0x10]
add dword [ebp + 0x38], eax
cmp dword [ebp + 0x38], 0
jge 0x463d8b
cmp byte [ebp + 0x67], 0
je 0x463c9c
cmp byte [ebp + 0x3f], 0
je 0x463d97
and dword [ebp + 0x34], 0
jmp 0x463dc1
xor edx, edx
lea eax, [esi + 0x260]
mov cl, byte [eax]
test cl, cl
jne 0x463da9
test edx, edx
jne 0x463db6
cmp cl, 5
je 0x463db6
cmp cl, 0xf
je 0x463db6
mov dword [ebp + 0x34], edx
inc edx
add eax, 0x90
cmp edx, 4
jl 0x463d9f
cmp byte [ebp + 0x3f], 0
jne 0x463dd1
cmp dword [ebp + 0x34], 0
jl 0x463c9c
cmp byte [ebp + 0x67], 0
je 0x46401a
mov eax, dword [ebp + 0x10]
test eax, eax
jg 0x463de5
mov eax, dword [ebp + 0x44]
lea eax, [eax + eax*8]
shl eax, 4
lea eax, [eax + edi + 0x30]
mov ecx, dword [eax + 8]
push 0
mov dword [ebp + 0x18], eax
mov eax, dword [eax + 0xc]
push 0x200
push eax
push ecx
mov dword [ebp - 0x230], eax
call fcn.004aa080
cmp dword [ebp + 0x40], 4
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], edx
jle 0x463f13
cmp dword [ebp + 0x38], 0
jge 0x463f13
cmp byte [esi + 0x20], 0
je 0x463ec7
mov eax, dword [ebp + 0x40]
cmp eax, 8
jle 0x463e47
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x463e4a
mov eax, dword [ebp + 0x44]
push 0
lea eax, [eax + eax*8]
push 0x200
shl eax, 4
push dword [eax + edi + 0x3c]
push dword [eax + edi + 0x38]
call fcn.004aa080
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x144], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 8]
push 0
adc ecx, dword [esi + 0xc]
push 0x200
push ecx
push eax
mov dword [ebp - 0x140], edx
call fcn.004aa080
mov ecx, eax
sub ecx, dword [ebp - 0x164]
mov dword [ebp - 0x1a0], ecx
mov ecx, edx
sbb ecx, dword [ebp - 0x160]
sub ebx, eax
mov dword [ebp - 0x19c], ecx
mov ecx, dword [ebp - 0x1e8]
sbb ecx, edx
add ebx, dword [ebp - 0x164]
adc ecx, dword [ebp - 0x160]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ecx
jmp 0x463f57
cmp dword [ebp + 0x10], 4
jne 0x46693a
mov eax, dword [ebp + 0x44]
test eax, eax
jl 0x46693a
mov ecx, dword [ebp - 0x8c]
cmp byte [ecx + 0x20], 0
je 0x46693a
mov edx, dword [ebp - 0xd8]
or dword [ebp + 0x10], 0xffffffff
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], edx
jmp 0x463f4f
cmp dword [ebp + 0x10], 0
jle 0x463f39
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 8]
mov eax, dword [eax + 0x14]
adc eax, dword [ebp - 0x230]
push 0
push 0x200
push eax
push ecx
call fcn.004aa080
mov ecx, dword [ebp - 0x1e8]
sub ebx, eax
sbb ecx, edx
add ebx, dword [ebp - 0x164]
adc ecx, dword [ebp - 0x160]
and dword [ebp - 0x6c], 0
and dword [ebp - 0x68], 0
test ecx, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], edx
jl 0x463c9c
jg 0x463f75
test ebx, ebx
jbe 0x463c9c
cmp byte [ebp - 0x46], 0
je 0x463f81
add dword [ebp + 0x4c], eax
adc dword [ebp + 0x50], edx
mov edi, eax
add edi, 1
mov esi, edx
adc esi, 0
cmp dword [ebp + 0x50], esi
jg 0x463f9d
jl 0x463f97
cmp dword [ebp + 0x4c], edi
ja 0x463f9d
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x50], esi
sub ebx, dword [ebp + 0x4c]
sbb ecx, dword [ebp + 0x50]
add ebx, eax
adc ecx, edx
cmp dword [ebp + 0x2c], ecx
jl 0x463fb9
jg 0x463fb3
cmp dword [ebp + 0x28], ebx
jbe 0x463fb9
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ecx
xor eax, eax
cmp dword [ebp + 0x2c], eax
jl 0x463c9c
jg 0x463fcf
cmp dword [ebp + 0x28], eax
jb 0x463c9c
cmp dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x40]
jle 0x463fed
dec eax
and eax, 0xfffffffc
cmp eax, 3
jg 0x463fe3
inc eax
jmp 0x463ff5
cdq
push 4
pop ecx
idiv ecx
add eax, ecx
jmp 0x463ff5
and eax, 0xfffffffc
cmp eax, 3
jg 0x463ff8
inc eax
jmp 0x464000
cdq
push 4
pop ecx
idiv ecx
add eax, ecx
mov dword [ebp + 0x60], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0xd0]
jmp 0x4640d4
mov eax, dword [ebp + 0x38]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + edi + 0x30]
push 0
mov edi, 0x200
push edi
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004aa080
push 0
push edi
push dword [esi + 0x14]
mov ebx, eax
push dword [esi + 0x10]
mov eax, edx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], eax
call fcn.004aa080
cmp byte [ebp - 0x46], 0
je 0x464070
add dword [ebp + 0x4c], ebx
mov ecx, dword [ebp - 0x1d8]
adc dword [ebp + 0x50], ecx
xor esi, esi
cmp dword [ebp + 0x50], esi
jl 0x464096
jg 0x46407e
cmp dword [ebp + 0x4c], esi
jbe 0x464096
mov ecx, dword [ebp - 0x1d8]
cmp dword [ebp + 0x50], ecx
jg 0x464096
jl 0x464090
cmp dword [ebp + 0x4c], ebx
ja 0x464096
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ecx
cmp dword [ebp + 0x2c], esi
jl 0x4640c8
jg 0x4640a2
cmp dword [ebp + 0x28], esi
jbe 0x4640c8
cmp dword [ebp + 0x2c], edx
jl 0x4640b4
jg 0x4640ae
cmp dword [ebp + 0x28], eax
jbe 0x4640b4
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], esi
jl 0x466942
jg 0x4640c8
cmp dword [ebp + 0x28], esi
jb 0x466942
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x14c], ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x148], eax
call fcn.0043db4f
mov edi, dword [ebp + 0x20]
xor ebx, ebx
cmp dword [ebp + 0x60], 4
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
setge byte [ebp - 0x51]
add eax, dword [ebp - 0xb0]
push ebx
adc ecx, dword [ebp - 0xac]
push 0x200
push ecx
push eax
call fcn.004aa130
cmp dword [ebp + 4], ebx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edx
je 0x46415f
cmp byte [ebp + 0x67], 0
je 0x46415f
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp + 0x4c]
mov ecx, dword [ebp - 0xac]
adc ecx, dword [ebp + 0x50]
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ecx
push eax
push dword [ebp + 0x6c]
call fcn.0043cc2f
add esp, 0x18
lea ecx, [ebp + 0x68]
call fcn.00441980
mov dword [ebp - 0x104], ebx
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x466b98
cmp edx, dword [ebp - 0x124]
jne 0x466b98
lea eax, [edi + edi*2]
push eax
lea ecx, [ebp - 4]
call fcn.00443e04
mov eax, dword [ebp - 4]
lea esi, [eax + edi]
lea eax, [edi - 1]
not eax
and esi, eax
push edi
mov dword [ebp + 0x38], esi
add esi, edi
push ebx
push esi
mov dword [ebp + 0x18], esi
call fcn.004aa020
add esp, 0xc
push ebx
lea eax, [ebp - 0x50]
push eax
push edi
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x466b90
push edi
push esi
push dword [ebp + 0x38]
call fcn.00413de4
add esp, 0xc
cmp byte [ebp + 0x5e], 0
je 0x4642c4
cmp byte [ebp + 0x64], 0
jne 0x4642c4
push esi
call fcn.00441952
cmp byte [ebp + 3], 0
pop ecx
jg 0x46421a
jge 0x464216
cmp dword [ebp - 0x38], ebx
lea eax, [edi + edi + 0x4000]
jg 0x46421a
jl 0x464216
cmp dword [ebp - 0x3c], eax
ja 0x46421a
xor al, al
jmp 0x46421c
mov al, 1
cmp byte [ebp + 0x5e], 1
jne 0x464257
test al, al
je 0x464245
cmp edi, 0x200
jbe 0x464245
lea eax, [edi - 0x200]
push eax
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.004aa020
add esp, 0xc
push pe_nt_image_headers32
lea eax, [esi + 0x1be]
push ebx
push eax
call fcn.004aa020
add esp, 0xc
push edi
push esi
push dword [ebp + 0x38]
mov word [esi + 0x1fe], 0xaa55
call fcn.0043dbb8
add esp, 0xc
test eax, eax
je 0x4642a4
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
push ebx
lea eax, [ebp - 0x50]
push eax
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0x50], ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov al, byte [ebp + 0x65]
or al, byte [ebp + 0x5f]
or al, byte [ebp + 0x26]
je 0x46696e
cmp dword [ebp - 0x14], ebx
jl 0x46696e
mov dword [ebp + 0x40], ebx
jmp 0x465c6a
cmp byte [ebp + 0x66], 2
je 0x4642e0
cmp byte [ebp + 0x1e], 0
jne 0x4642e0
cmp byte [ebp - 0x29], 0
je 0x4642ef
cmp dword [ebp + 0x60], 1
jle 0x46444b
cmp byte [ebp - 0x29], 0
je 0x4642ef
cmp dword [ebp + 0x60], ebx
jl 0x46444b
push 0x100000
lea ecx, [ebp + 0x14]
call fcn.00443e04
cmp dword [ebp - 0x24], ebx
mov dword [ebp + 4], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
jl 0x464330
push dword [ebp + 0x6c]
mov esi, dword [ebp + 0x14]
call fcn.004414b9
pop ecx
push ebx
push edi
push edx
push eax
call fcn.004aa080
mov esi, dword [ebp - 0xe0]
jmp 0x46439a
mov esi, dword [ebp - 0xe0]
cmp esi, ebx
jl 0x464356
jg 0x464344
cmp dword [ebp - 0xe4], ebx
jb 0x464356
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], esi
lea eax, [ebp - 0x268]
push eax
push ebx
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x4643e0
test byte [ebp - 0x268], 0x10
jne 0x4643e0
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x248]
and eax, 0xfffffe00
xor edx, edx
shld edx, eax, 0x17
shl eax, 0x17
shr ecx, 9
xor edi, edi
or eax, ecx
or edx, edi
sub eax, dword [ebp - 0xb0]
sbb edx, dword [ebp - 0xac]
cmp esi, ebx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
jl 0x4643e0
jg 0x4643c0
cmp dword [ebp - 0xe4], ebx
jbe 0x4643e0
cmp edx, esi
ja 0x4643e0
jb 0x4643ce
cmp eax, dword [ebp - 0xe4]
jae 0x4643e0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], esi
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x6c]
call fcn.0044170d
mov esi, eax
mov eax, dword [ebp - 0xc0]
mov cx, word [eax]
add esp, 0xc
cmp cx, bx
jne 0x464406
cmp esi, ebx
je 0x464443
cmp esi, ebx
je 0x46440e
mov eax, dword [esi]
jmp 0x464410
xor eax, eax
cmp eax, 1
sete byte [ebp + 0x57]
cmp byte [ebp + 0x57], 0
je 0x464427
cmp byte [ebp - 0x7d], 0
mov byte [ebp + 0x1f], 1
je 0x46442b
mov byte [ebp + 0x1f], 0
cmp byte [ebp - 0x75], 0
jne 0x46448b
cmp byte [ebp + 0x5e], 0
jne 0x46448b
cmp byte [ebp + 0x1f], 0
je 0x464485
cmp byte [ebp + 0x64], 0
jne 0x46448b
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
je 0x46447b
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, 0x80070057
jmp 0x466bfb
cmp byte [ebp + 0x64], 0
jne 0x464443
cmp cx, bx
mov eax, dword [ebp - 0x114]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp + 0x10], eax
jne 0x464558
xor eax, eax
mov dword [ebp - 0x22c], ebx
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
push 0x18
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
cmp dword [ebp - 0x110], ebx
jg 0x464508
jl 0x4644f2
cmp dword [ebp - 0x114], ebx
ja 0x464508
mov eax, dword [ebp - 0x220]
mov dword [ebp + 0x44], eax
cdq
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], edx
cmp dword [ebp - 0x12c], ebx
jg 0x464530
jl 0x46451a
cmp dword [ebp - 0x130], ebx
ja 0x464530
mov eax, dword [ebp - 0x21c]
mov dword [ebp + 0x40], eax
cdq
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x118], ebx
jg 0x464558
jl 0x464542
cmp dword [ebp - 0x11c], ebx
ja 0x464558
mov eax, dword [ebp - 0x218]
mov dword [ebp + 0x10], eax
cdq
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x110], ebx
jg 0x46457e
jl 0x46456a
cmp dword [ebp - 0x114], ebx
ja 0x46457e
mov eax, 0xff
mov dword [ebp + 0x44], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ebx
cmp dword [ebp - 0x12c], ebx
jg 0x4645a2
jl 0x464590
cmp dword [ebp - 0x130], ebx
ja 0x4645a2
push 0x3f
pop eax
mov dword [ebp + 0x40], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x118], ebx
jg 0x4645d5
jl 0x4645b4
cmp dword [ebp - 0x11c], ebx
ja 0x4645d5
mov eax, dword [ebp + 0x20]
cmp eax, ebx
mov dword [ebp + 0x10], eax
ja 0x4645c5
mov dword [ebp + 0x10], 0x200
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
mov eax, dword [ebp + 0x10]
cdq
mov edi, 0x200
mov ecx, edi
idiv ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x20]
lea ebx, [ecx + eax]
add eax, ebx
mov dword [ebp - 0xc], eax
add eax, 0x10000
cmp byte [ebp + 0x1f], 0
mov dword [ebp - 0x170], eax
jne 0x464edb
cmp byte [ebp + 0x64], 0
jne 0x464edb
cmp byte [ebp + 0xb], 0
mov byte [ebp + 0x57], 0
jne 0x464aa6
mov esi, dword [ebp + 0x50]
xor eax, eax
cmp esi, eax
jg 0x464647
jl 0x464633
cmp dword [ebp + 0x4c], eax
jae 0x464647
cmp dword [ebp + 0x2c], eax
jl 0x464aa6
jg 0x464647
cmp dword [ebp + 0x28], eax
jb 0x464aa6
mov ebx, dword [ebp + 0x60]
cmp ebx, eax
jl 0x464aa6
push 0x100000
lea ecx, [ebp - 0x34]
call fcn.00402d04
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 0x40]
cdq
idiv edi
mov edi, eax
imul eax, dword [ebp + 0x44]
cmp dword [ebp + 0x10], 0
cdq
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], edx
jle 0x4669a1
mov eax, dword [ebp - 0xc0]
cmp word [eax], 0
jne 0x4646c4
and dword [ebp + 4], 0
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x34]
push dword [ebp + 0x6c]
call fcn.0044170d
add esp, 0xc
test eax, eax
je 0x4669b9
cmp ebx, 4
jl 0x4646c4
cmp byte [ebp + 0x67], 0
jne 0x4646c4
cmp ebx, dword [ebp + 4]
jge 0x4669a1
xor edx, edx
xor eax, eax
cmp esi, edx
jl 0x464779
jg 0x4646db
cmp dword [ebp + 0x4c], edx
jbe 0x464779
mov ecx, dword [ebp - 0xa0]
and ecx, dword [ebp - 0x9c]
cmp ecx, 0xffffffff
jne 0x46471a
cmp esi, dword [ebp - 0x168]
jl 0x464715
jg 0x464701
mov eax, dword [ebp + 0x4c]
cmp eax, dword [ebp - 0x16c]
jb 0x464715
cmp byte [ebp - 0x51], 0
jne 0x464715
push dword [ebp - 0x168]
push dword [ebp - 0x16c]
jmp 0x464765
mov eax, edi
cdq
jmp 0x464763
cmp byte [ebp - 0x47], 0
jne 0x464779
mov eax, dword [ebp + 0x10]
cdq
mov ecx, eax
add ecx, dword [ebp - 0xa0]
mov edi, edx
adc edi, dword [ebp - 0x9c]
push edx
sub ecx, 1
push eax
sbb edi, 0
push edi
push ecx
call fcn.004aa080
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.004aa130
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
push edx
push eax
push esi
push dword [ebp + 0x4c]
call fcn.00441896
add esp, 0x10
add dword [ebp + 0x4c], eax
adc esi, edx
mov dword [ebp + 0x50], esi
xor ecx, ecx
cmp dword [ebp + 0x2c], ecx
jl 0x4647a5
jg 0x464787
cmp dword [ebp + 0x28], ecx
jbe 0x4647a5
cmp byte [ebp - 0x7e], 0
jne 0x4647a5
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp + 0x2c], ecx
jg 0x4647a5
jl 0x46479f
cmp dword [ebp + 0x28], ecx
jae 0x4647a5
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
cmp esi, ecx
jl 0x4647b7
jg 0x4647b0
cmp dword [ebp + 0x4c], ecx
jbe 0x4647b7
mov edi, dword [ebp + 0x4c]
mov ebx, esi
jmp 0x4647bb
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0x2c], 0
jl 0x46485a
jg 0x4647d1
cmp dword [ebp + 0x28], 0
jbe 0x46485a
mov eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x70]
cmp eax, 0xffffffff
jne 0x4647f7
push dword [ebp - 0x168]
add edi, dword [ebp + 0x28]
push dword [ebp - 0x16c]
adc ebx, dword [ebp + 0x2c]
push ebx
push edi
call fcn.004ac3d0
jmp 0x464854
cmp byte [ebp - 0x47], 0
jne 0x46485a
mov eax, dword [ebp + 0x10]
cdq
mov esi, eax
add eax, dword [ebp - 0x74]
mov ecx, edx
adc ecx, dword [ebp - 0x70]
push edx
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
mov dword [ebp - 0x18c], edx
call fcn.004aa080
push dword [ebp - 0x18c]
push esi
push edx
push eax
call fcn.004aa130
push 0
push 0x200
push edx
push eax
call fcn.004aa080
add edi, dword [ebp + 0x28]
push edx
adc ebx, dword [ebp + 0x2c]
push eax
push ebx
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
call fcn.004ac3d0
mov esi, dword [ebp + 0x50]
sub dword [ebp + 0x28], eax
sbb dword [ebp + 0x2c], edx
cmp dword [ebp - 0x68], 0
mov byte [ebp + 0x57], 0
mov byte [ebp + 0x3f], 0
mov byte [ebp + 0x1f], 0
jl 0x464987
jg 0x46487c
cmp dword [ebp - 0x6c], 0
jbe 0x464987
mov ecx, dword [ebp + 0x28]
sub ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp + 0x2c]
sbb edi, dword [ebp - 0xd0]
add ecx, dword [ebp + 0x4c]
cdq
push edx
push eax
adc edi, esi
push edi
push ecx
call fcn.004aa080
and dword [ebp - 0x1b0], 0
mov ebx, eax
xor eax, eax
push 1
push dword [ebp + 0x44]
lea edi, [ebp - 0x1ac]
push dword [ebp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x1a0]
lea eax, [ebp + 0x1f]
push eax
lea eax, [ebp + 0x3f]
push eax
lea eax, [ebp + 0x57]
push eax
push dword [ebp - 0x19c]
mov dword [ebp - 0x6c], ebx
push edi
mov dword [ebp - 0x68], edx
call fcn.004418c0
mov al, byte [ebp + 0x3f]
add esp, 0x20
push 1
push dword [ebp + 0x44]
mov byte [ebp - 0x1af], al
mov al, byte [ebp + 0x1f]
push dword [ebp + 0x40]
mov byte [ebp - 0x1ae], al
mov al, byte [ebp + 0x57]
mov byte [ebp - 0x1ad], al
lea eax, [ebp + 0x1f]
push eax
lea eax, [ebp + 0x3f]
push eax
lea eax, [ebp + 0x57]
push eax
push 0
push 2
push dword [ebp - 0x19c]
mov byte [ebp - 0x1b0], 0
push edi
call fcn.004aa130
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.004418c0
mov al, byte [ebp + 0x3f]
mov byte [ebp - 0x1ab], al
mov al, byte [ebp + 0x1f]
mov byte [ebp - 0x1aa], al
mov al, byte [ebp + 0x57]
push 1
mov byte [ebp - 0x1a9], al
lea eax, [ebp - 0x1b0]
push eax
push dword [ebp - 0x140]
mov byte [ebp - 0x1ac], 5
push dword [ebp - 0x144]
mov dword [ebp - 0x1a8], edi
push dword [ebp + 0x6c]
mov dword [ebp - 0x1a4], ebx
call fcn.00452355
add esp, 0x34
mov eax, dword [ebp - 0x8c]
cdq
mov ebx, edx
push ebx
mov edi, eax
push edi
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
call fcn.004aa080
test esi, esi
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], edx
jl 0x4649d9
jg 0x4649be
xor eax, eax
cmp dword [ebp + 0x4c], eax
jb 0x4649db
push ebx
push edi
push esi
push dword [ebp + 0x4c]
call fcn.004aa080
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], edx
xor eax, eax
jmp 0x4649e7
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp + 0x2c], eax
jl 0x464a08
jg 0x4649f3
cmp dword [ebp + 0x28], eax
jb 0x464a08
push ebx
push edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
call fcn.004aa080
mov dword [ebp - 0x108], edx
jmp 0x464a0e
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
xor eax, eax
cmp dword [ebp + 0x60], 4
mov ebx, dword [ebp - 0xe8]
mov edi, dword [ebp - 0xec]
setge al
push eax
push dword [ebp + 0x44]
lea eax, [ebp + 0x1d]
push dword [ebp + 0x40]
push eax
lea eax, [ebp - 0xa1]
push eax
lea eax, [ebp + 0x30]
push eax
push ebx
push edi
call fcn.004418c0
add esp, 0x20
test esi, esi
jl 0x464a6d
jg 0x464a55
cmp dword [ebp + 0x4c], 0
jbe 0x464a6d
sub edi, dword [ebp - 0x1f4]
sbb ebx, dword [ebp - 0x1f0]
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe8], ebx
mov al, byte [ebp - 0x51]
mov byte [ebp + 0x57], al
movsx eax, al
push eax
push dword [ebp + 0x44]
lea eax, [ebp + 2]
push dword [ebp + 0x40]
push eax
lea eax, [ebp - 0x45]
push eax
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x10c]
lea eax, [edi + eax - 1]
push 0
push eax
call fcn.004418c0
add esp, 0x20
lea ecx, [ebp - 0x34]
call fcn.0043db4f
mov ebx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x18]
shl ebx, 4
cmp byte [ebp + 0x66], 2
lea edi, [ebx + esi]
je 0x4669de
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x38]
call fcn.00413de4
add esp, 0xc
cmp dword [ebp - 0x68], 0
jl 0x464b08
jg 0x464ad9
cmp dword [ebp - 0x6c], 0
jb 0x464b08
cmp dword [ebp + 0x34], 0
jle 0x464af1
push ebx
push 0
add esi, 0x1be
push esi
call fcn.004aa020
add esp, 0xc
push 0x30
pop eax
sub eax, ebx
push eax
lea eax, [edi + 0x1ce]
push 0
push eax
call fcn.004aa020
add esp, 0xc
cmp byte [ebp + 0x67], 0
mov al, byte [edi + 0x1c2]
jne 0x464b2a
cmp byte [ebp + 0x1e], 2
jge 0x464b2a
cmp al, 5
je 0x4669a9
cmp al, 0xf
je 0x4669a9
cmp byte [ebp + 0x67], 0
mov esi, dword [edi + 0x1c6]
mov ecx, dword [edi + 0x1ca]
jne 0x464ba0
test al, al
je 0x464ba0
xor ebx, ebx
cmp dword [ebp - 0x58], ebx
je 0x464ba2
cmp byte [ebp + 0x1e], 2
jge 0x464ba2
cmp byte [ebp - 0x51], bl
jne 0x464ba2
cmp dword [ebp + 0x50], ebx
jl 0x464b78
jg 0x464b5e
cmp dword [ebp + 0x4c], ebx
jb 0x464b78
xor eax, eax
cmp dword [ebp - 0xec], esi
jne 0x464443
cmp dword [ebp - 0xe8], eax
jne 0x464443
cmp dword [ebp + 0x2c], ebx
jl 0x464ba2
jg 0x464b84
cmp dword [ebp + 0x28], ebx
jb 0x464ba2
xor eax, eax
cmp dword [ebp - 0x10c], ecx
jne 0x464b96
cmp dword [ebp - 0x108], eax
je 0x464ba2
cmp ecx, ebx
jne 0x464443
jmp 0x464ba2
xor ebx, ebx
cmp byte [ebp + 0xb], 0
je 0x464bc4
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x58]
cmp eax, ebx
jl 0x464bd1
mov byte [edi + 0x1c2], al
mov eax, dword [ebp - 0xa8]
cmp ax, bx
jl 0x464be2
mov byte [edi + 0x1be], al
cmp dword [ebp + 0x50], ebx
jg 0x464c0e
jl 0x464bee
cmp dword [ebp + 0x4c], ebx
jae 0x464c0e
cmp dword [ebp + 0x2c], ebx
jl 0x464c87
jg 0x464c02
cmp dword [ebp + 0x28], ebx
jb 0x464c87
mov eax, dword [ebp - 0x10c]
lea eax, [esi + eax - 1]
jmp 0x464c24
cmp dword [ebp + 0x2c], ebx
jg 0x464c45
jl 0x464c1a
cmp dword [ebp + 0x28], ebx
jae 0x464c45
mov eax, dword [ebp - 0xec]
lea eax, [ecx + eax - 1]
movsx ecx, byte [ebp + 0x57]
push ecx
push dword [ebp + 0x44]
lea ecx, [ebp + 2]
push dword [ebp + 0x40]
push ecx
lea ecx, [ebp - 0x45]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push ebx
push eax
call fcn.004418c0
add esp, 0x20
cmp dword [ebp + 0x50], ebx
jl 0x464c7b
jg 0x464c51
cmp dword [ebp + 0x4c], ebx
jb 0x464c7b
mov al, byte [ebp - 0xa1]
mov byte [edi + 0x1bf], al
mov al, byte [ebp + 0x1d]
mov byte [edi + 0x1c0], al
mov al, byte [ebp + 0x30]
mov byte [edi + 0x1c1], al
mov eax, dword [ebp - 0xec]
mov dword [edi + 0x1c6], eax
cmp dword [ebp + 0x2c], ebx
jg 0x464c93
jl 0x464c87
cmp dword [ebp + 0x28], ebx
jae 0x464c93
cmp dword [ebp + 0x50], ebx
jl 0x464cae
jg 0x464c93
cmp dword [ebp + 0x4c], ebx
jb 0x464cae
mov al, byte [ebp - 0x45]
mov byte [edi + 0x1c3], al
mov al, byte [ebp + 2]
mov byte [edi + 0x1c4], al
mov al, byte [ebp - 0x7c]
mov byte [edi + 0x1c5], al
cmp dword [ebp + 0x2c], ebx
jl 0x464cc6
jg 0x464cba
cmp dword [ebp + 0x28], ebx
jb 0x464cc6
mov eax, dword [ebp - 0x10c]
mov dword [edi + 0x1ca], eax
cmp dword [ebp - 0x58], ebx
jge 0x464cec
cmp word [ebp - 0xa8], bx
jge 0x464cec
cmp dword [ebp + 0x50], ebx
jg 0x464cec
jl 0x464ce0
cmp dword [ebp + 0x4c], ebx
jae 0x464cec
cmp dword [ebp + 0x2c], ebx
jl 0x464cff
jg 0x464cec
cmp dword [ebp + 0x28], ebx
jb 0x464cff
mov esi, dword [ebp + 0x18]
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
jmp 0x464d02
mov esi, dword [ebp + 0x18]
cmp word [ebp - 0xa8], bx
jge 0x464d36
cmp dword [ebp - 0x58], ebx
jge 0x464d36
cmp dword [ebp + 0x50], ebx
jg 0x464d36
jl 0x464d1c
cmp dword [ebp + 0x4c], ebx
jae 0x464d36
cmp dword [ebp + 0x2c], ebx
jg 0x464d36
jl 0x464d28
cmp dword [ebp + 0x28], ebx
jae 0x464d36
mov byte [esi + 0x1fe], 0x55
mov byte [esi + 0x1ff], 0xaa
push ebx
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, dword [ebp - 0x128]
jne 0x466b88
cmp edx, dword [ebp - 0x124]
jne 0x466b88
mov eax, dword [ebp - 0x14c]
or eax, dword [ebp - 0x148]
mov dword [ebp + 0x40], 1
jne 0x464d82
push esi
call fcn.00441952
pop ecx
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x38]
call fcn.0044422d
add esp, 0xc
test eax, eax
jne 0x464db3
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x40], eax
call fcn.0044193a
pop ecx
cmp dword [ebp + 0x50], ebx
jl 0x464eaf
jg 0x464dcb
cmp dword [ebp + 0x4c], 0x200
jb 0x464eaf
cmp dword [ebp + 0x2c], 0
jl 0x464eaf
jg 0x464de4
cmp dword [ebp + 0x28], 0x200
jbe 0x464eaf
cmp byte [ebp - 0x95], 0
jle 0x464eaf
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x18]
call fcn.004aa020
add esp, 0xc
push 0
push 0x200
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
call fcn.004aa130
mov esi, eax
mov ebx, edx
mov edi, esi
add edi, dword [ebp - 0x3c]
mov dword [ebp - 0x200], ebx
adc ebx, dword [ebp - 0x38]
push 0
push ebx
push edi
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, esi
jne 0x464eab
cmp edx, dword [ebp - 0x200]
jne 0x464eab
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x38]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
mov dword [ebp + 0x40], eax
je 0x464eab
mov eax, dword [ebp + 0x20]
cmp dword [ebp - 0x50], eax
jne 0x464eab
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x38]
call fcn.0044422d
add esp, 0xc
test eax, eax
jne 0x464eaf
push eax
push ebx
push edi
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, esi
jne 0x464eab
cmp edx, dword [ebp - 0x200]
jne 0x464eab
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp + 0x40], eax
jmp 0x464eaf
and dword [ebp + 0x40], 0
xor eax, eax
cmp dword [ebp + 0x40], eax
sete al
cmp byte [ebp + 0x5f], 0
mov esi, eax
mov dword [ebp - 0x10], esi
jne 0x464ed2
cmp byte [ebp + 0x65], 0
jne 0x464ed2
cmp byte [ebp + 0x26], 0
je 0x466bc3
and dword [ebp + 0x40], 0
jmp 0x465c62
cmp byte [ebp + 0xb], 0
je 0x464ee5
mov byte [ebp - 0x27], 0
cmp byte [ebp + 0x57], 0
je 0x464ef9
cmp byte [ebp + 0x5e], 0
jne 0x464ef9
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x38], eax
jmp 0x464f00
mov dword [ebp + 0x38], 0x80
mov eax, dword [ebp - 0x8c]
cdq
mov edi, edx
push edi
mov esi, eax
push esi
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
call fcn.004aa080
push edi
push esi
push dword [ebp - 0xe0]
mov dword [ebp + 0x4c], eax
push dword [ebp - 0xe4]
mov dword [ebp + 0x50], edx
call fcn.004aa080
push edi
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0xe4], eax
push dword [ebp + 0x28]
mov dword [ebp - 0xe0], edx
call fcn.004aa080
mov esi, eax
sub esi, 1
mov edi, edx
sbb edi, 0
cmp byte [ebp - 0x1e], 0
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], edx
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf0], edi
je 0x464f88
mov esi, eax
add esi, dword [ebp + 0x4c]
mov edi, edx
adc edi, dword [ebp + 0x50]
sub esi, 1
sbb edi, 0
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf0], edi
and dword [ebp - 0x100], 0
and dword [ebp - 0xfc], 0
cmp byte [ebp + 0x5e], 1
jne 0x465014
test byte [ebp - 0x48], 0x10
je 0x464fc6
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xe0]
mov esi, eax
sub esi, 1
mov edi, ecx
sbb edi, 0
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0xf0], edi
jmp 0x464fd2
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x154]
cmp dword [ebp + 0x50], 0
jg 0x464feb
jl 0x464fe0
cmp dword [ebp + 0x4c], 1
jae 0x464feb
and dword [ebp + 0x50], 0
mov dword [ebp + 0x4c], 1
test edi, edi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], edi
jg 0x46501a
jl 0x465002
cmp esi, 1
jae 0x46501a
sub eax, 1
sbb ecx, 0
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], ecx
cmp byte [ebp + 0x5e], 0
je 0x465022
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x50]
jmp 0x465026
xor eax, eax
xor ecx, ecx
push dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push dword [ebp - 0x3c]
push edx
push ecx
push eax
push dword [ebp + 0x20]
lea eax, [ebp + 0x6c]
push dword [ebp + 0x38]
push dword [ebp + 0x14]
push eax
call fcn.00448b86
add esp, 0x24
cmp byte [ebp + 0x57], 0
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], edx
jne 0x465071
or eax, edx
jne 0x465071
and dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 1
cmp dword [ebp - 0xfc], 0
jl 0x4669a9
jg 0x46508d
cmp dword [ebp - 0x100], 0x20
jb 0x4669a9
cmp byte [ebp + 0x66], 2
mov eax, dword [ebp + 0x38]
je 0x466c36
cmp dword [ebp + 0x60], eax
mov dword [ebp + 4], 1
jae 0x4650ce
cmp dword [ebp - 0x60], eax
jge 0x4650ce
cmp dword [ebp + 0x60], 0
jl 0x4650d2
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0xc]
push 0x10
push 0x4c31e0
push eax
call fcn.0043dbb8
add esp, 0xc
test eax, eax
jne 0x4650d2
and dword [ebp + 4], 0
mov ecx, dword [ebp + 0x20]
xor edx, edx
lea eax, [ecx + 0x3fff]
div ecx
cmp byte [ebp + 0x5e], 1
mov dword [ebp + 0x10], eax
jne 0x465411
mov eax, dword [ebp + 0x38]
cmp dword [ebp + 0x60], eax
jae 0x4669a9
mov edx, dword [ebp - 0xc]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp - 0x94]
shl eax, 7
inc edx
imul edx, ecx
mov ecx, 0x4800
sub ecx, edx
cmp byte [ebp + 3], 0
mov dword [ebp - 0x7c], eax
mov dword [ebp + 0x30], ecx
jg 0x46514b
jge 0x465138
xor edx, edx
cmp dword [ebp - 0x38], edx
jg 0x46514b
jl 0x465138
mov edx, dword [ebp + 0x20]
lea edx, [edx + edx + 0x4000]
cmp dword [ebp - 0x3c], edx
ja 0x46514b
xor edx, edx
test eax, eax
mov byte [ebp + 0x1d], 0
mov dword [ebp + 0x34], edx
jle 0x4651ee
jmp 0x46519d
cmp dword [ebp + 0x20], 0x200
mov byte [ebp + 0x1d], 1
jbe 0x465174
mov eax, dword [ebp + 0x20]
add eax, 0xfffffe00
push eax
mov eax, dword [ebp + 0x14]
add eax, 0x200
push 0
push eax
call fcn.004aa020
add esp, 0xc
mov eax, dword [ebp + 0x20]
add eax, 0xffffffa4
push eax
lea eax, [ebx + 0x5c]
push 0
push eax
call fcn.004aa020
push 0x4000
push 0
push dword [ebp - 0xc]
call fcn.004aa020
add esp, 0x18
jmp 0x4651ee
mov ecx, dword [ebp + 0x30]
cmp edx, ecx
jl 0x4651b7
push 0x10
push 0
push dword [ebp + 0x18]
call fcn.004aa020
add esp, 0xc
mov eax, 0x80
jmp 0x4651e0
push 0x1b0
push 0
push dword [ebp + 0x18]
call fcn.004aa020
mov eax, dword [ebp + 0x18]
push pe_nt_image_headers32
add eax, 0x1be
push 0
push eax
call fcn.004aa020
add esp, 0x18
mov eax, 0x200
add dword [ebp + 0x34], eax
mov edx, dword [ebp + 0x34]
add dword [ebp + 0x18], eax
cmp edx, dword [ebp - 0x7c]
jl 0x46519a
push 0x38
push 0
push ebx
call fcn.004aa020
push 0x14
lea eax, [ebx + 0x48]
push 0
push eax
call fcn.004aa020
mov eax, dword [ebp + 0x14]
push pe_nt_image_headers32
add eax, 0x1be
push 0
push eax
call fcn.004aa020
mov eax, dword [ebp + 0x14]
add esp, 0x24
cmp byte [ebp + 0x1d], 0
mov word [eax + 0x1fe], 0xaa55
jne 0x46523b
cmp dword [ebp + 0x20], 0x200
jbe 0x46523b
mov word [ebx - 2], 0xaa55
push 8
push 0x4c6348
push ebx
call fcn.00413de4
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp - 0x100]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x50]
push dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x1d4], eax
add eax, dword [ebp + 0x4c]
mov dword [ebp - 0x1d0], edx
adc edx, dword [ebp + 0x50]
add eax, 1
adc edx, 0
mov dword [ebx + 0x20], ecx
sub ecx, dword [ebp - 0x1d4]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0xfc]
sbb eax, dword [ebp - 0x1d0]
add ecx, 0xffffffff
adc eax, 0xffffffff
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], eax
call fcn.00441952
lea eax, [ebx + 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0x10
cmp ecx, 0x20323354
jne 0x4652d7
cmp edx, 0x2020
je 0x465311
cmp ecx, 0x20363154
jne 0x4652e7
cmp edx, 0x2020
je 0x465311
mov esi, ecx
or esi, edx
je 0x46530b
cmp ecx, 0xffffffff
jne 0x4652f6
cmp edx, ecx
je 0x46530b
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov esi, ecx
or esi, edx
je 0x46530b
cmp ecx, 0xffffffff
jne 0x46532f
cmp edx, ecx
jne 0x46532f
mov esi, dword [ebp - 0xf4]
push 0xc
push 0x4c6338
push eax
call fcn.00413de4
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1b8]
add esp, 0xc
mov dword [ebx + 0x44], eax
jmp 0x465335
mov esi, dword [ebp - 0xf4]
lea eax, [ebx - 0x174]
push eax
call fcn.00441952
mov eax, dword [ebp + 0x4c]
add eax, 1
pop ecx
mov ecx, dword [ebp + 0x50]
adc ecx, 0
test edi, edi
mov dword [ebx + 0x48], eax
mov eax, 0x80
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
jg 0x465378
jl 0x46536a
cmp esi, 1
jae 0x465378
or dword [ebp - 0xf4], 0xffffffff
or dword [ebp - 0xf0], 0xffffffff
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x14]
push 1
push dword [ebp + 0x44]
shl eax, 4
push dword [ebp + 0x40]
lea edi, [eax + ecx]
lea eax, [edi + 0x1bf]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push dword [ebp + 0x50]
mov dword [edi + 0x1c2], 0xee
push dword [ebp + 0x4c]
call fcn.004418c0
lea eax, [edi + 0x1c3]
add esp, 0x20
cmp byte [ebp + 0x64], 2
lea ecx, [eax + 1]
lea edx, [eax + 2]
mov byte [eax], 0xfe
mov byte [ecx], 0xff
mov byte [edx], 0xfe
jne 0x4653ed
push 1
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push ecx
push eax
push edx
push dword [ebp - 0xf0]
push dword [ebp - 0xf4]
call fcn.004418c0
add esp, 0x20
mov eax, dword [ebp + 0x4c]
mov dword [edi + 0x1c6], eax
add edi, 0x1ca
or dword [edi], 0xffffffff
cmp byte [ebp + 0x64], 2
jne 0x46571c
mov eax, dword [ebp - 0xf4]
mov dword [edi], eax
cmp byte [ebp + 0x5e], 0
jg 0x46571c
cmp byte [ebp - 0x49], 0
jle 0x46542b
cmp dword [ebp + 0x60], 0
jl 0x46571c
cmp byte [ebp + 0x67], 0
je 0x465481
or dword [ebp + 0x60], 0xffffffff
xor esi, esi
cmp dword [ebp + 0x38], esi
mov byte [ebp - 0x27], 0
jbe 0x465481
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x7c], eax
mov edi, 0x80
push 0x10
push 0x4c31e0
push dword [ebp - 0x7c]
call fcn.0043dbb8
add esp, 0xc
test eax, eax
je 0x46546c
add dword [ebp - 0x7c], edi
inc esi
cmp esi, dword [ebp + 0x38]
jb 0x46544b
jmp 0x465481
mov dword [ebp + 0x60], esi
push edi
shl esi, 7
add esi, dword [ebp - 0xc]
push 0
push esi
call fcn.004aa020
add esp, 0xc
mov eax, dword [ebp + 0x38]
dec dword [ebp - 0x60]
cmp dword [ebp + 0x60], eax
jae 0x4669a9
cmp dword [ebp - 0x60], eax
jge 0x4669a9
cmp byte [ebp - 0x27], 0
je 0x465599
xor ecx, ecx
cmp byte [ebp + 0x57], cl
je 0x4654f6
mov eax, dword [ebp - 0xc]
add eax, 0x20
cmp ecx, dword [ebp + 0x38]
jae 0x4654f6
mov edx, dword [eax]
cmp edx, dword [ebp + 0x4c]
jne 0x4654c4
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x50]
je 0x4654cc
inc ecx
add eax, 0x80
jmp 0x4654b0
mov edx, dword [ebp - 0xc]
mov eax, ecx
shl eax, 7
add eax, edx
cmp ecx, dword [ebp + 0x60]
mov esi, 0x4c31e0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x4654f6
push 0x80
push 0
push eax
call fcn.004aa020
add esp, 0xc
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
shl eax, 7
push 0x10
add eax, ecx
push 0x4c31e0
push eax
mov dword [ebp + 0x30], eax
call fcn.0043dbb8
add esp, 0xc
test eax, eax
je 0x465583
mov edi, dword [ebp + 0x60]
inc edi
cmp edi, dword [ebp + 0x38]
mov dword [ebp + 0x44], edi
jae 0x4669a9
mov esi, edi
shl esi, 7
add esi, dword [ebp - 0xc]
push 0x10
push 0x4c31e0
push esi
call fcn.0043dbb8
add esp, 0xc
test eax, eax
je 0x465555
inc edi
add esi, 0x80
cmp edi, dword [ebp + 0x38]
mov dword [ebp + 0x44], edi
jb 0x465530
jmp 0x465577
cmp edi, dword [ebp + 0x60]
jle 0x465577
mov eax, dword [ebp + 0x44]
mov edi, eax
shl edi, 7
add edi, dword [ebp - 0xc]
sub eax, dword [ebp + 0x60]
dec eax
lea edx, [edi - 0x80]
push 0x20
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
jne 0x465568
mov eax, dword [ebp + 0x38]
cmp dword [ebp + 0x44], eax
jae 0x4669a9
push 0x80
push 0
push dword [ebp + 0x30]
call fcn.004aa020
add esp, 0xc
and dword [ebp + 4], 0
cmp byte [ebp + 0x5e], 1
je 0x4656fd
mov eax, dword [ebp - 0x60]
xor ecx, ecx
cmp eax, ecx
jge 0x4656b6
cmp dword [ebp + 4], ecx
jne 0x4655dc
xor eax, eax
inc eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x174], ecx
jle 0x4655f9
mov edi, dword [ebp + 0x60]
shl edi, 7
add edi, dword [ebp - 0xc]
lea esi, [ebp - 0x1c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x178], ecx
jle 0x46561a
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
shl eax, 7
lea edi, [eax + ecx + 0x10]
lea esi, [ebp - 0x214]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp dword [ebp - 0x17c], ecx
mov eax, dword [ebp - 0xc]
jle 0x465639
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x4c]
shl edx, 7
mov dword [edx + eax + 0x20], esi
mov esi, dword [ebp + 0x50]
mov dword [edx + eax + 0x24], esi
cmp dword [ebp - 0x180], ecx
jle 0x46565b
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0xf4]
shl edx, 7
mov dword [edx + eax + 0x28], esi
mov esi, dword [ebp - 0xf0]
mov dword [edx + eax + 0x2c], esi
cmp dword [ebp - 0x188], ecx
jle 0x46567d
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp - 0x15c]
shl edx, 7
mov dword [edx + eax + 0x30], esi
mov esi, dword [ebp - 0x158]
mov dword [edx + eax + 0x34], esi
cmp dword [ebp - 0x184], ecx
jle 0x4656fd
mov eax, dword [ebp - 0x30]
cmp word [eax], 0
je 0x4656fd
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
shl eax, 7
push 0x48
lea esi, [eax + ecx + 0x38]
push 0
push esi
call fcn.004aa020
add esp, 0xc
push 0x24
push dword [ebp - 0x30]
push esi
call dword [sym.imp.SHLWAPI.DLL_StrCpyNW]
jmp 0x4656fd
cmp eax, dword [ebp + 0x60]
je 0x4656fd
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp - 0xc]
shl ecx, 7
lea edx, [ecx + eax]
push 0x20
pop ecx
mov esi, edx
lea edi, [ebp - 0x34c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x60]
shl ecx, 7
add eax, ecx
push 0x20
pop ecx
mov esi, eax
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp + 0x60], eax
push 0x20
pop ecx
lea esi, [ebp - 0x34c]
rep movsd dword es:[edi], dword [esi]
jge 0x4656fd
mov dword [ebp + 0x60], eax
cmp byte [ebp + 0xb], 0
je 0x46571c
mov eax, dword [ebp + 0x60]
shl eax, 7
add eax, dword [ebp - 0xc]
push 0x80
push 0
push eax
call fcn.004aa020
add esp, 0xc
and dword [ebp + 0x44], 0
cmp byte [ebp - 0x49], 1
jne 0x465846
cmp byte [ebp + 0x5e], 1
je 0x465846
and dword [ebp - 0x8c], 0
mov eax, dword [ebp + 0x38]
and dword [ebp + 0x34], 0
dec eax
test eax, eax
mov dword [ebp - 0x7c], eax
jl 0x465846
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x40], eax
xor esi, esi
push 0x10
push 0x4c31e0
push dword [ebp + 0x18]
call fcn.0043dbb8
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ebp + 0x1d], al
jne 0x465784
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp - 0x8c]
mov dword [ebp + 0x30], esi
je 0x46578b
mov dword [ebp + 0x30], 1
cmp byte [ebp + 0x1d], 0
mov dword [ebp + 4], esi
jne 0x465804
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + 0x34], eax
je 0x4657f5
push 0x38
push dword [ebp + 0x18]
push dword [ebp + 0x40]
call fcn.004ac560
add esp, 0xc
test eax, eax
je 0x4657ca
push 0x38
push dword [ebp + 0x18]
mov dword [ebp + 4], 1
push dword [ebp + 0x40]
call fcn.004aa6d0
add esp, 0xc
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x40]
push 0x24
add esi, 0x38
push esi
add edi, 0x38
push edi
call dword [sym.imp.SHLWAPI.DLL_StrCmpNW]
test eax, eax
je 0x4657f5
push 0x24
push esi
push edi
mov dword [ebp + 4], 1
call dword [sym.imp.SHLWAPI.DLL_StrCpyNW]
inc dword [ebp - 0x8c]
add dword [ebp + 0x40], 0x80
xor esi, esi
cmp dword [ebp + 0x30], esi
je 0x465824
cmp byte [ebp + 0x1d], 0
jne 0x465824
push 0x10
push esi
push dword [ebp + 0x18]
mov dword [ebp + 4], 1
call fcn.004aa020
add esp, 0xc
cmp dword [ebp + 4], esi
je 0x465830
mov eax, dword [ebp + 0x34]
inc eax
mov dword [ebp + 0x44], eax
inc dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
add dword [ebp + 0x18], 0x80
cmp eax, dword [ebp - 0x7c]
jle 0x465759
push 8
push 0x4c6348
push ebx
call fcn.00413de4
push dword [ebp + 0x14]
call fcn.00441952
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, eax
add esp, 0x10
or edx, ecx
je 0x465873
cmp eax, 0xffffffff
jne 0x465880
cmp ecx, eax
jne 0x465880
lea eax, [ebx - 0x174]
push eax
call fcn.00441952
pop ecx
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x44], eax
jg 0x46588c
inc eax
mov dword [ebp + 0x44], eax
cmp byte [ebp + 0x5e], 1
mov eax, dword [ebp + 0x38]
jne 0x465898
mov dword [ebp + 0x44], eax
push 0
shl eax, 7
push 0
push eax
push dword [ebp - 0xc]
call fcn.004968a1
mov esi, dword [ebx + 0xc]
add esp, 0x10
cmp esi, 0x20000
mov dword [ebx + 0x58], eax
ja 0x4669a9
xor eax, eax
push eax
push eax
push esi
push ebx
mov dword [ebx + 0x10], eax
call fcn.004968a1
mov edi, dword [ebp - 0x170]
push esi
push ebx
push edi
mov dword [ebx + 0x10], eax
call fcn.00413de4
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x24]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x1c]
and dword [edi + 0x10], 0
mov dword [edi + 0x24], eax
push 0
xor eax, eax
push eax
push esi
push edi
call fcn.004968a1
mov esi, dword [ebp + 0x20]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x10]
add esp, 0x2c
inc eax
imul eax, esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443e04
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x44]
shl eax, 7
lea eax, [eax + esi - 1]
xor edx, edx
div esi
push 0
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
imul eax, esi
mov dword [ebp - 0x170], eax
call fcn.0040f222
push esi
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x6c]
call fcn.00402ccf
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
call fcn.004ac560
add esp, 0xc
test eax, eax
je 0x465985
push 0
push dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push dword [ebp - 0x3c]
call fcn.0040f222
push esi
push dword [ebp + 0x14]
lea ecx, [ebp + 0x6c]
call fcn.0043d954
mov eax, dword [ebp - 0x170]
xor edx, edx
div esi
mov ecx, dword [ebp - 0x90]
xor edx, edx
push edx
push edx
push esi
push ecx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0xc4], ecx
inc eax
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x94]
push eax
mov dword [ebp - 0xc8], eax
call fcn.004aa130
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040f222
mov eax, dword [ebp + 0x18]
imul eax, esi
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x6c]
call fcn.00402ccf
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
jle 0x465aad
jmp 0x465a10
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x38]
call fcn.004ac560
add esp, 0xc
test eax, eax
jne 0x465a15
inc ebx
add dword [ebp - 0xc8], 1
adc dword [ebp - 0xc4], eax
add dword [ebp + 0x20], esi
add dword [ebp + 0x38], esi
cmp ebx, dword [ebp + 0x18]
jl 0x4659e9
cmp ebx, dword [ebp + 0x10]
jge 0x465aad
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1f8], eax
jmp 0x465a66
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x38]
call fcn.004ac560
add esp, 0xc
test eax, eax
je 0x465a6b
inc ebx
add dword [ebp - 0xc8], 1
adc dword [ebp - 0xc4], 0
add dword [ebp + 0x20], esi
add dword [ebp + 0x38], esi
cmp ebx, dword [ebp + 0x18]
jl 0x465a3e
push 0
xor eax, eax
push eax
push esi
push dword [ebp - 0x1f8]
push dword [ebp - 0x1fc]
call fcn.004aa130
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040f222
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x30]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0x30]
call fcn.0043d954
cmp ebx, dword [ebp + 0x18]
jl 0x4659e9
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x100]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x10]
cdq
sub ebx, eax
mov eax, dword [ebp - 0xfc]
sbb eax, edx
push 0
xor ecx, ecx
push ecx
push esi
push eax
push ebx
mov dword [ebp - 0xc4], eax
call fcn.004aa130
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040f222
mov eax, dword [ebp + 0x10]
imul eax, esi
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x6c]
call fcn.00402ccf
and dword [ebp + 0x44], 0
cmp dword [ebp + 0x10], 0
jle 0x465be0
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x44], eax
jge 0x465be0
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x38]
call fcn.004ac560
add esp, 0xc
test eax, eax
jne 0x465b49
inc dword [ebp + 0x44]
add ebx, 1
adc dword [ebp - 0xc4], eax
mov eax, dword [ebp + 0x44]
add dword [ebp + 0x20], esi
add dword [ebp + 0x38], esi
cmp eax, dword [ebp + 0x10]
jl 0x465b1c
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x44], eax
jge 0x465be0
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1e0], eax
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x38]
call fcn.004ac560
add esp, 0xc
test eax, eax
je 0x465b9b
inc dword [ebp + 0x44]
mov eax, dword [ebp + 0x44]
add ebx, 1
adc dword [ebp - 0xc4], 0
add dword [ebp + 0x20], esi
add dword [ebp + 0x38], esi
cmp eax, dword [ebp + 0x10]
jl 0x465b6d
push 0
xor eax, eax
push eax
push esi
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call fcn.004aa130
add eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x6c]
adc edx, dword [ebp - 0x38]
push edx
push eax
call fcn.0040f222
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x30]
lea ecx, [ebp + 0x6c]
push eax
push dword [ebp + 0x30]
call fcn.0043d954
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x44], eax
jl 0x465b10
xor eax, eax
push eax
push esi
push dword [ebp - 0xfc]
push dword [ebp - 0x100]
call fcn.004aa130
mov ebx, eax
add ebx, dword [ebp - 0x3c]
push 0
adc edx, dword [ebp - 0x38]
lea ecx, [ebp + 0x6c]
push edx
push ebx
mov dword [ebp - 0x134], edx
call fcn.0040f222
push esi
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x6c]
call fcn.00402ccf
push esi
push edi
push dword [ebp - 0x1c]
call fcn.004ac560
add esp, 0xc
test eax, eax
je 0x465c47
push 0
push dword [ebp - 0x134]
lea ecx, [ebp + 0x6c]
push ebx
call fcn.0040f222
push esi
push edi
lea ecx, [ebp + 0x6c]
call fcn.0043d954
mov al, byte [ebp + 0x65]
or al, byte [ebp + 0x5f]
lea ecx, [ebp - 0x1c]
or al, byte [ebp + 0x26]
je 0x466e5c
and dword [ebp + 0x40], 0
call fcn.0043db4f
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
mov bl, byte [ebp + 0x27]
xor edi, edi
cmp dword [ebp - 0x24], edi
jl 0x465d10
cmp bl, 0x20
je 0x465c92
cmp bl, 0x10
jne 0x465c98
cmp dword [ebp - 0x44], 0xb
je 0x465cbc
test byte [ebp + 0x5f], 0x20
jne 0x465cbc
cmp byte [ebp + 0x5f], 0
je 0x465caa
cmp dword [ebp - 0x44], 0xb
je 0x465cbc
test byte [ebp + 0x65], 0x20
jne 0x465cbc
cmp byte [ebp + 0x65], 0
je 0x465d10
cmp dword [ebp - 0x44], 0xb
jne 0x465d10
cmp byte [ebp - 0x28], 0
jg 0x465d70
test byte [0x4d8458], 0x20
jne 0x465ce1
test byte [ebp + 0x68], 0x20
jne 0x465ce1
push 1
push dword [ebp - 0x24]
call fcn.00452655
pop ecx
pop ecx
or byte [ebp + 0x68], 2
test byte [0x4d8458], 0x10
jne 0x465d0c
test byte [ebp + 0x68], 0x11
jne 0x465d0c
push edi
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push edi
push dword [ebp - 0x24]
call fcn.004051f3
add esp, 0x1c
or byte [ebp + 0x68], 1
or byte [ebp + 0x68], 1
cmp byte [ebp - 0x28], 0
jg 0x465d70
cmp byte [ebp + 0x26], 0
jne 0x465d2c
cmp bl, 1
je 0x465d2c
cmp bl, 0x20
je 0x465d2c
cmp byte [ebp + 0x5f], 0
je 0x465d70
push dword [ebp + 0x6c]
call fcn.0044193a
pop ecx
push edi
lea eax, [ebp - 0x198]
push eax
push edi
push edi
push edi
push edi
push 0x70140
push dword [ebp + 0x6c]
mov dword [ebp - 0x198], edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x465d5d
xor eax, eax
jmp 0x465d63
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp bl, 1
je 0x465d6d
cmp bl, 0x20
jne 0x465d70
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
xor esi, esi
test byte [ebp + 0x65], 0x20
jne 0x465d97
cmp byte [ebp + 0x65], 0
je 0x465d8c
cmp dword [ebp - 0x44], 0xb
je 0x465d97
test bl, 0x10
je 0x465dcf
cmp dword [ebp - 0x44], 0xc
je 0x465dcf
lea ecx, [ebp + 0x68]
call fcn.00441980
cmp byte [ebp - 0x28], 0
jg 0x465dcf
xor eax, eax
cmp bl, 0x18
setne al
push 0x4bdf58
dec eax
and eax, 0x17
inc eax
push eax
push edi
push dword [ebp - 0xf8]
call fcn.0045178c
add esp, 0x10
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp byte [ebp + 0x4b], 0
je 0x466e38
cmp dword [ebp + 0x40], edi
je 0x466e38
xor ebx, ebx
or esi, 0xffffffff
jmp 0x463763
cmp dword [ebp - 0x14], ebx
jge 0x465e00
mov ecx, dword [ebp - 0xc0]
cmp word [ecx], bx
je 0x46445b
mov edi, 0x1b8
mov dword [ebp + 0x44], edi
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
cmp word [eax], bx
je 0x465f5a
push dword [ebp - 8]
push 0x4c6334
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x465f5a
push dword [ebp - 8]
push 0x4c22c8
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x465f5a
mov edi, dword [ebp - 8]
push edi
push 0x4c6330
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x465e78
mov dword [ebp + 0x34], 0x4d6380
mov dword [ebp + 0x44], 0x190
jmp 0x465f76
push edi
push 0x4c632c
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x465e9c
mov dword [ebp + 0x34], 0x4d6510
mov dword [ebp + 0x44], 0x180
jmp 0x465f76
mov dword [ebp + 0x44], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
jne 0x465ed3
lea eax, [ebp - 0x94]
push eax
inc edi
lea eax, [ebp - 8]
inc edi
push eax
mov dword [ebp - 8], edi
call fcn.00448ed1
mov edi, dword [ebp - 8]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x465ed3
inc edi
inc edi
cmp word [edi], 0x23
jne 0x465f11
push edi
lea ecx, [ebp + 0x30]
call fcn.0044cd74
push ebx
lea eax, [ebp - 0x194]
push eax
push 0x4bdbe8
push dword [ebp + 0x30]
push ebx
call fcn.00414db6
add esp, 0x14
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x34], eax
call fcn.0043db4f
mov eax, dword [ebp - 0x190]
mov dword [ebp + 0x44], eax
jmp 0x465f28
lea eax, [ebp + 0x44]
push eax
push ebx
push edi
call fcn.0040fae3
add esp, 0xc
mov dword [ebp + 0x34], eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x90], ebx
jl 0x465f64
jg 0x465f3a
cmp dword [ebp - 0x94], ebx
jb 0x465f64
cmp ebx, dword [ebp - 0x90]
jl 0x465f64
jg 0x465f4f
mov eax, dword [ebp + 0x44]
cmp eax, dword [ebp - 0x94]
jbe 0x465f64
mov eax, dword [ebp - 0x94]
mov dword [ebp + 0x44], eax
jmp 0x465f64
mov dword [ebp + 0x34], 0x4d6690
mov dword [ebp + 0x44], edi
cmp dword [ebp + 0x44], ebx
jbe 0x46611c
cmp dword [ebp + 0x34], ebx
je 0x46611c
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xf8]
lea ecx, [ebp + 0x6c]
call fcn.0040569f
cmp dword [ebp + 0x6c], ebx
je 0x46611c
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.0044132f
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x465fb5
mov edi, esi
mov ecx, dword [ebp + 0x44]
lea eax, [edi - 1]
add ecx, eax
not eax
and ecx, eax
cmp ecx, edi
mov dword [ebp - 0x64], ecx
mov ebx, ecx
jge 0x465fcc
mov ebx, edi
lea eax, [edi + ebx*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.00443e04
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xb0]
lea esi, [edi - 1]
add eax, edi
not esi
and esi, eax
xor eax, eax
xor edx, edx
or ecx, dword [ebp - 0xac]
lea edi, [esi + ebx]
je 0x46600b
push edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x4660fc
cmp edx, dword [ebp - 0x38]
jne 0x4660fc
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4660fc
push dword [ebp - 0x64]
push edi
push esi
call fcn.00413de4
mov ecx, dword [ebp + 0x44]
mov eax, 0x1b8
add esp, 0xc
cmp ecx, eax
jle 0x466053
mov ecx, eax
mov ebx, dword [ebp + 0x34]
push ecx
push ebx
push edi
call fcn.00413de4
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp + 0x44]
add esp, 0xc
cmp eax, 0x200
jbe 0x466095
add eax, 0xfffffe00
push eax
add ebx, 0x200
lea eax, [edi + 0x200]
push ebx
push eax
call fcn.00413de4
add esp, 0xc
push dword [ebp - 0x64]
push edi
push esi
call fcn.0044422d
add esp, 0xc
test eax, eax
jne 0x4660e4
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x10
cmp eax, dword [ebp - 0x3c]
jne 0x4660fc
cmp edx, dword [ebp - 0x38]
jne 0x4660fc
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x64]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.0044193a
test esi, esi
pop ecx
je 0x4660fc
lea ecx, [ebp - 0x30]
call fcn.0043db4f
lea ecx, [ebp - 0x194]
call fcn.0043db4f
jmp 0x466b65
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test esi, esi
jne 0x466109
inc esi
lea ecx, [ebp - 0x30]
call fcn.0043db4f
lea ecx, [ebp - 0x194]
jmp 0x466544
lea ecx, [ebp - 0x194]
call fcn.0043db4f
jmp 0x466ba0
cmp ecx, ebx
jle 0x46445b
cmp dword [ebp - 0x14], ebx
jge 0x466148
mov eax, dword [ebp - 0xc0]
cmp word [eax], bx
je 0x46445b
xor eax, eax
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp + 0x30], esi
jge 0x466167
xor al, al
jne 0x466191
jmp 0x46445b
push dword [ebp - 0x5c]
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0xc]
push ecx
push dword [ebp - 0x14]
push eax
call fcn.00461938
add esp, 0x1c
cmp dword [ebp + 0x30], ebx
jle 0x466ba0
mov edi, dword [ebp - 0xb4]
mov dword [ebp - 8], 0x200
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
cmp word [edi], bx
je 0x466328
push edi
push 0x4c6334
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x466328
push edi
push 0x4c22c8
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x466328
push edi
push 0x4c632c
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x4661fb
push 8
jmp 0x46632a
push edi
push 0x4c6324
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x466324
push edi
push 0x4c631c
call fcn.0043ef29
test al, al
pop ecx
pop ecx
jne 0x466324
push edi
push 0x4c6330
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x46623d
push 6
jmp 0x46632a
push edi
push 0x4c6314
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x466255
push 5
jmp 0x46632a
mov dword [ebp - 8], ebx
cmp word [edi], 0x2a
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
jne 0x466295
lea eax, [ebp - 0x94]
push eax
inc edi
lea eax, [ebp - 0xb4]
inc edi
push eax
mov dword [ebp - 0xb4], edi
call fcn.00448ed1
mov edi, dword [ebp - 0xb4]
cmp word [edi], 0x2a
pop ecx
pop ecx
jne 0x466295
inc edi
inc edi
cmp word [edi], 0x23
jne 0x4662d3
push edi
lea ecx, [ebp + 0x30]
call fcn.0044cd74
push ebx
lea eax, [ebp - 0x13c]
push eax
push 0x4bdbe8
push dword [ebp + 0x30]
push ebx
call fcn.00414db6
add esp, 0x14
lea ecx, [ebp + 0x30]
mov dword [ebp - 0x44], eax
call fcn.0043db4f
mov eax, dword [ebp - 0x138]
mov dword [ebp - 8], eax
jmp 0x4662ea
lea eax, [ebp - 8]
push eax
push ebx
push edi
call fcn.0040fae3
add esp, 0xc
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x90], ebx
jl 0x46631a
jg 0x4662fc
cmp dword [ebp - 0x94], ebx
jb 0x46631a
cmp ebx, dword [ebp - 0x90]
jl 0x46631a
jg 0x466311
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x94]
jbe 0x46631a
mov eax, dword [ebp - 0x94]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x44], ebx
jne 0x466353
jmp 0x4663c9
push 7
jmp 0x46632a
push 9
pop eax
push ebx
lea ecx, [ebp - 0x13c]
push ecx
push 0x4bd49c
push eax
push ebx
call fcn.00414db6
add esp, 0x14
cmp dword [ebp - 8], ebx
mov dword [ebp - 0x44], eax
je 0x4663c9
mov eax, dword [ebp - 0x138]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jbe 0x4663c9
cmp dword [ebp - 0x44], ebx
je 0x4663c9
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xf8]
lea ecx, [ebp + 0x6c]
call fcn.0040569f
cmp dword [ebp + 0x6c], ebx
je 0x4663c9
push ebx
push 0x200
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.004aa130
mov esi, eax
add esi, dword [ebp - 0x15c]
mov edi, edx
adc edi, dword [ebp - 0x158]
push ebx
push edi
push esi
push dword [ebp + 0x6c]
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], edi
call fcn.0043edf6
add esp, 0x10
cmp eax, esi
jne 0x4663c9
cmp edx, edi
je 0x4663d4
lea ecx, [ebp - 0x13c]
jmp 0x466122
mov esi, 0x200
push esi
push dword [ebp + 0x6c]
call fcn.0044132f
cmp eax, esi
pop ecx
pop ecx
mov edi, eax
jge 0x4663ec
mov edi, esi
mov ecx, dword [ebp - 8]
lea eax, [edi - 1]
lea esi, [eax + ecx]
not eax
and esi, eax
lea eax, [edi + esi*2]
push eax
lea ecx, [ebp + 4]
call fcn.00443e04
mov eax, dword [ebp + 4]
lea ebx, [edi - 1]
add eax, edi
push 0
not ebx
and ebx, eax
lea eax, [ebp - 0x50]
push eax
push esi
lea edi, [ebx + esi]
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x466458
lea ecx, [ebp + 4]
call fcn.0043db4f
lea ecx, [ebp - 0x13c]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
test eax, eax
jmp 0x466bb7
push esi
push edi
push ebx
call fcn.00413de4
push 0
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
push dword [ebp + 0x6c]
call fcn.0043edf6
add esp, 0x1c
cmp eax, dword [ebp - 0xdc]
jne 0x466429
cmp edx, dword [ebp - 0xd8]
jne 0x466429
mov eax, dword [ebp - 8]
push 3
push dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
push edi
call fcn.00413de4
mov eax, 0x1fe
add esp, 0xc
cmp dword [ebp - 0x30], eax
jle 0x4664aa
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 0xffffffe2
push eax
mov eax, dword [ebp - 0x44]
add eax, 0x1e
push eax
lea eax, [edi + 0x1e]
push eax
call fcn.00413de4
mov byte [edi + 0x1fe], 0x55
mov byte [edi + 0x1ff], 0xaa
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, 0x200
jbe 0x4664fa
add eax, 0xfffffe00
push eax
mov eax, dword [ebp - 0x44]
add eax, 0x200
push eax
lea eax, [edi + 0x200]
push eax
call fcn.00413de4
add esp, 0xc
push esi
push edi
push ebx
mov dword [ebp + 0x40], 1
call fcn.0044422d
add esp, 0xc
test eax, eax
jne 0x46652c
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp + 0x6c]
mov dword [ebp + 0x40], eax
call fcn.0044193a
pop ecx
xor eax, eax
cmp dword [ebp + 0x40], eax
lea ecx, [ebp + 4]
sete al
mov esi, eax
call fcn.0043db4f
lea ecx, [ebp - 0x13c]
call fcn.0043db4f
jmp 0x466bdb
push 0x103c
lea ecx, [ebp + 0xc]
call fcn.00443fa0
mov esi, dword [ebp + 0xc]
mov ax, word [edi]
add esi, 0x2000
cmp ax, bx
mov dword [ebp + 0x34], 0x4bdf58
je 0x4665ba
cmp word [edi + 2], 0x3a
jne 0x4665ba
movzx eax, ax
push eax
push 0x4c6304
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
jne 0x4665ac
cmp dword [ebp - 0x84], 0x10
jne 0x466609
mov dword [ebp + 0x34], 0x4bdf38
cmp eax, 5
jne 0x466609
mov dword [ebp + 0x34], 0x4bdf48
jmp 0x466609
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jl 0x466609
cmp dword [ebp - 0x84], 8
jne 0x4665e0
push eax
push 0x4c57f0
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
mov dword [ebp + 0x34], 0x4bdf48
jmp 0x466606
cmp dword [ebp - 0x84], 0x10
jne 0x4665f9
and eax, 0xfff
mov esi, eax
mov dword [ebp + 0x34], 0x4bdf38
jmp 0x466609
push eax
push 0x4c57c8
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
movzx eax, word [ebp - 0x88]
push dword [ebp + 0x34]
or eax, 0x20
push eax
push dword [ebp + 0xc]
push esi
call fcn.0045178c
mov ecx, dword [ebp - 0xb8]
add esp, 0x10
push dword [ebp + 0xc]
push dword [ebp - 0xbc]
call fcn.00443666
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
jmp 0x466b7c
cmp byte [ebp - 0x25], 0
je 0x466662
cmp dword [ebp - 0x24], ebx
jl 0x466f2e
mov al, byte [ebp - 0x26]
neg al
sbb eax, eax
and eax, 0x200000
or eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x120]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00461589
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp word [ecx], bx
sete al
mov dword [ebp - 0x10], eax
jmp 0x466f2e
cmp dword [ebp - 0x24], ebx
jl 0x466f2e
cmp byte [ebp - 0x1d], 0
je 0x4666ad
cmp ecx, ebx
jl 0x466f2e
push dword [ebp - 0x5c]
movsx eax, byte [ebp - 0x26]
or eax, dword [ebp - 0x18]
push ebx
push ebx
push eax
push ecx
push dword [ebp - 0x24]
lea eax, [ebp + 0xc]
push eax
call fcn.00461938
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 0x10], ecx
jmp 0x466f2e
cmp dword [ebp - 0x14], ebx
jge 0x466737
cmp word [edi], bx
je 0x466737
cmp word [edi + 2], 0x3a
jne 0x466734
cmp word [edi + 4], bx
jne 0x466734
mov word [ebp - 0x2cc], 0x5c
mov word [ebp - 0x2ca], 0x5c
mov word [ebp - 0x2c8], 0x2e
mov word [ebp - 0x2c6], 0x5c
mov ax, word [edi]
mov word [ebp - 0x2c4], ax
mov word [ebp - 0x2c2], 0x3a
mov word [ebp - 0x2c0], bx
lea edi, [ebp - 0x2cc]
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x466f2e
cmp byte [ebp - 0x1d], 0
je 0x46674e
cmp ecx, ebx
jl 0x466f2e
push dword [ebp - 0x84]
lea eax, [ebp + 0xc]
push dword [ebp - 0x24]
push eax
push dword [ebp - 0xb8]
call fcn.00452149
add esp, 0x10
jmp 0x46668e
mov eax, dword [ebp - 0xcc]
movzx edi, word [eax]
and edi, 0xffffffdf
cmp dword [ebp - 0x84], ebx
lea esi, [edi - 0x41]
jle 0x4667f9
push 0x3b60
lea ecx, [ebp + 0x30]
call fcn.00443e04
mov eax, dword [ebp + 0x30]
mov edx, edi
shl edx, 0x10
or edx, dword [ebp - 0x84]
lea ecx, [eax + 0x200]
push edx
push eax
push ecx
mov dword [ebp - 0x198], ecx
call fcn.00451b41
imul esi, esi, 0x220
mov eax, dword [ebp - 0x198]
add esi, eax
add esp, 0xc
cmp dword [esi + 8], ebx
jle 0x4667ec
push 0x64
lea ecx, [ebp + 0xc]
call fcn.00443fa0
push edi
push dword [esi + 4]
push 0x4c1498
push dword [ebp + 0xc]
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x10], ebx
lea ecx, [ebp + 0x30]
call fcn.0043db4f
jmp 0x466f26
mov cx, word [eax]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
cmp word [eax], 0x5c
jne 0x46680b
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
je 0x466f26
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0xc]
push dword [ebp - 0x24]
push eax
call fcn.00461938
xor ecx, ecx
add esp, 0x1c
test eax, eax
setle cl
mov dword [ebp - 0x10], ecx
jmp 0x466f26
cmp dword [ebp - 0x14], ebx
jge 0x4668b5
cmp word [edi], bx
je 0x4668b3
cmp word [edi + 2], 0x3a
jne 0x4668a6
cmp word [edi + 4], 0x5c
jne 0x466869
cmp word [edi + 6], bx
jne 0x466869
mov word [edi + 4], bx
cmp word [edi + 4], bx
jne 0x4668a6
push 9
lea ecx, [ebp + 0x58]
call fcn.00443fa0
mov eax, dword [ebp + 0x58]
mov word [eax], 0x5c
mov word [eax + 2], 0x5c
mov word [eax + 4], 0x2e
mov word [eax + 6], 0x5c
mov cx, word [edi]
mov word [eax + 8], cx
mov word [eax + 0xa], 0x3a
mov word [eax + 0xc], bx
jmp 0x4668b3
push esi
push edi
lea ecx, [ebp + 0x58]
call fcn.0044407f
mov eax, dword [ebp + 0x58]
mov ecx, esi
cmp ecx, ebx
jg 0x4668bb
mov ecx, esi
push eax
mov eax, dword [ebp - 0x18]
shl eax, 0x10
and ecx, 0xf000ffff
or ecx, eax
push ecx
push dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push eax
call fcn.00404ea0
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x466f26
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp + 0x58]
mov esi, eax
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
jmp 0x466bf2
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
jmp 0x4637ac
lea ecx, [ebp - 0x40]
jmp 0x466b58
lea ecx, [ebp - 0x40]
jmp 0x4669cc
lea ecx, [ebp - 0x40]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, esi
jmp 0x464472
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
je 0x463724
push eax
jmp 0x46371e
lea ecx, [ebp - 0x34]
call fcn.0043db4f
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
jmp 0x463c9f
lea ecx, [ebp - 0x34]
call fcn.0043db4f
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
jmp 0x46643c
push 0x28
lea ecx, [ebp + 0xc]
call fcn.00443fa0
mov esi, dword [ebp + 0x60]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
test esi, esi
push 4
mov dword [ebp - 0x88], 0x4bca0c
pop eax
jl 0x466a14
lea edx, [esi + 1]
cmp edx, eax
mov ecx, esi
jge 0x466a0c
mov eax, edx
cmp esi, eax
jge 0x466b20
mov esi, dword [ebp + 0x18]
mov edi, dword [sym.imp.USER32.DLL_wsprintfW]
lea edx, [ecx + 1]
mov dword [ebp - 0x5c], edx
mov edx, ecx
shl edx, 4
sub eax, ecx
lea esi, [edx + esi + 0x1c6]
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x60], 0
mov al, byte [esi - 4]
mov byte [ebp - 0x1e], al
jge 0x466a86
cmp al, 5
je 0x466a4d
cmp al, 0xf
mov ecx, 0x4bca0c
jne 0x466a52
mov ecx, 0x4c6300
xor edx, edx
test al, al
setne dl
lea edx, [edx + edx - 1]
imul edx, dword [ebp - 0x5c]
push edx
push ecx
push dword [ebp - 0x88]
push 0x4c62f0
push ebx
call edi
add esp, 0x14
lea ebx, [ebx + eax*2]
mov dword [ebp - 0x88], 0x4bd48c
jmp 0x466b11
test al, al
je 0x466b11
push dword [ebp - 0x5c]
push dword [ebp - 0x88]
push 0x4c62e4
push ebx
call edi
add esp, 0x10
test byte [ebp - 0x18], 1
lea ebx, [ebx + eax*2]
mov eax, 0x4c62d8
jne 0x466ab5
mov eax, 0x4c62d0
movzx ecx, byte [ebp - 0x1e]
push ecx
push eax
push ebx
call edi
lea ebx, [ebx + eax*2]
movzx eax, byte [esi - 8]
shr eax, 7
push eax
push 0x4c62d0
push ebx
call edi
lea ebx, [ebx + eax*2]
mov eax, dword [esi]
mov ecx, 0x200
mul ecx
push 0x4c62c0
push edx
push eax
push ebx
call fcn.00497e6e
add esp, 0x28
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ebx, [ebx + eax*2]
mov eax, dword [esi + 4]
mov ecx, 0x200
mul ecx
push 0x4c62c0
push edx
push eax
push ebx
call fcn.00497e6e
add esp, 0x10
inc dword [ebp - 0x5c]
add esi, 0x10
dec dword [ebp + 0x30]
jne 0x466a34
cmp dword [ebp - 0x64], 0
jle 0x466b39
push dword [ebp - 0x64]
lea eax, [ebp + 0xc]
push dword [ebp - 0xb8]
call fcn.00448e12
pop ecx
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0xb8]
push dword [ebp - 0xbc]
call fcn.00443666
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
test eax, eax
je 0x46301a
push eax
jmp 0x463014
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
je 0x463693
push eax
jmp 0x46368d
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
test eax, eax
je 0x466bfb
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp - 0xc0]
call fcn.0043db4f
lea ecx, [ebp - 0xbc]
call fcn.0043db4f
lea ecx, [ebp - 0xcc]
call fcn.0043db4f
lea ecx, [ebp - 0x1cc]
call fcn.0043db4f
lea ecx, [ebp + 0xc]
call fcn.0043db4f
mov eax, esi
jmp 0x466fb1
lea eax, [eax + eax*4]
shl eax, 1
push eax
lea ecx, [ebp + 0xc]
call fcn.00443fa0
mov edx, dword [ebp + 0x60]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x38]
xor ecx, ecx
test edx, edx
mov dword [ebp - 0x88], 0x4bca0c
jl 0x466c66
mov ecx, edx
inc edx
cmp eax, edx
jle 0x466c66
mov eax, edx
cmp ecx, eax
jge 0x466dd6
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [ecx + 1]
mov dword [ebp - 0x34], edx
mov edx, ecx
shl edx, 7
add edx, dword [ebp - 0xc]
sub eax, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x466ca0
mov ecx, dword [eax + 8]
or ecx, dword [eax + 0xc]
je 0x466dc3
cmp dword [ebp + 0x60], 0
push dword [ebp - 0x34]
push dword [ebp - 0x88]
jge 0x466ccd
push 0x4c62e4
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x88], 0x4bd48c
jmp 0x466dc0
push 0x4c62b4
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
mov ecx, dword [ebp - 0xc]
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x60]
shl eax, 7
lea edi, [eax + ecx]
push 0
push edi
push esi
call fcn.00441539
add esp, 0x1c
push esi
call ebx
lea esi, [esi + eax*2]
push 0x4c62a8
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0
push 0x200
push dword [edi + 0x24]
add esi, 0xa
push dword [edi + 0x20]
call fcn.004aa130
push edx
push eax
push esi
call fcn.00497eb9
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
inc esi
inc esi
sub eax, dword [edi + 0x20]
push 0
sbb ecx, dword [edi + 0x24]
add eax, 1
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.004aa130
push edx
push eax
push esi
call fcn.00497eb9
add esp, 0xc
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0x4c6164
push dword [edi + 0x34]
inc esi
push dword [edi + 0x30]
inc esi
push esi
call fcn.00497e6e
add esp, 0x10
push esi
call ebx
lea esi, [esi + eax*2]
mov word [esi], 0x20
push 0
inc esi
add edi, 0x10
inc esi
push edi
push esi
call fcn.00441539
add esp, 0xc
test byte [ebp - 0x18], 0x10
je 0x466dc3
push esi
call ebx
push dword [ebp - 0x34]
lea esi, [esi + eax*2]
mov word [esi], 0x20
inc esi
inc esi
push 0x4bd214
push esi
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
lea esi, [esi + eax*2]
add dword [ebp - 0x30], 0x80
inc dword [ebp - 0x34]
dec dword [ebp + 0x30]
jne 0x466c8a
xor esi, esi
cmp dword [ebp - 0x64], esi
jle 0x466df0
push dword [ebp - 0x64]
lea eax, [ebp + 0xc]
push dword [ebp - 0xb8]
call fcn.00448e12
pop ecx
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0xb8]
push dword [ebp - 0xbc]
call fcn.00443666
lea ecx, [ebp + 0x14]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, esi
jmp 0x466bf2
cmp bl, 0x10
je 0x466e40
mov esi, dword [ebp - 0x10]
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, edi
jmp 0x466bf2
call fcn.0043db4f
jmp 0x466b4d
push 0x1000
lea ecx, [ebp + 0xc]
call fcn.00443fa0
cmp dword [ebp - 0x14], ebx
jl 0x466efd
push 0x3b60
lea ecx, [ebp + 0x30]
call fcn.00443e04
mov edi, dword [ebp + 0x30]
push 0x3960
lea esi, [edi + 0x200]
push ebx
push esi
call fcn.004aa020
push dword [ebp - 0x84]
push edi
push esi
call fcn.00451b41
add esp, 0x18
xor edi, edi
lea eax, [esi + 4]
mov ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
je 0x466ec7
inc edi
add eax, 0x220
cmp edi, 0x1a
jle 0x466eb3
jmp 0x466ef3
push 0x64
lea ecx, [ebp + 0xc]
call fcn.00443fa0
imul edi, edi, 0x220
lea eax, [edi + esi]
movzx ecx, byte [eax + 0x10]
push ecx
push dword [eax + 4]
push 0x4c6298
push dword [ebp + 0xc]
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0x10
lea ecx, [ebp + 0x30]
call fcn.0043db4f
jmp 0x466f23
cmp byte [ebp - 0x25], 0
jne 0x466f23
cmp byte [ebp + 0x66], 4
mov eax, 0x4bdf48
je 0x466f13
mov eax, 0x4bdf38
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.0045178c
add esp, 0x10
mov dword [ebp - 0x10], ebx
lea ecx, [ebp + 0x58]
call fcn.0043db4f
cmp dword [ebp - 0x64], ebx
jle 0x466f46
push dword [ebp - 0x64]
lea eax, [ebp + 0xc]
push dword [ebp - 0xb8]
call fcn.00448e12
pop ecx
pop ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0xb8]
push dword [ebp - 0xbc]
call fcn.00443666
lea ecx, [ebp + 0x68]
call fcn.00441980
lea ecx, [ebp + 0x6c]
call fcn.00402cb5
mov eax, 0x4d88b0
cmp eax, ebx
je 0x466f7a
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp - 0xc0]
call fcn.0043db4f
lea ecx, [ebp - 0xbc]
call fcn.0043db4f
lea ecx, [ebp - 0xcc]
call fcn.0043db4f
lea ecx, [ebp - 0x1cc]
call fcn.0043db4f
lea ecx, [ebp + 0xc]
call fcn.0043db4f
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8