Function at 0x450dd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xd
add esp, 0xfffff004
push eax
dec eax
jne 0x450de1
mov eax, dword [ebp - 4]
add esp, 0xfffff9b4
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4c3188
mov eax, 0x4b1248
call fcn.004a0204
cmp dword [esi + 8], 0
je 0x450e6a
push dword [esi + 8]
call sub.KERNEL32.DLL_GlobalSize
mov edi, eax
push edi
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x450e3d
xor eax, eax
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
jmp 0x45276a
push ebx
call sub.KERNEL32.DLL_GlobalLock
push edi
push dword [esi + 8]
push eax
call fcn.0049fbe4
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, ebx
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
jmp 0x45276a
mov edx, 0x4d3714
mov eax, str.Rar_DRXXXXXX
call fcn.004667e4
test al, al
jne 0x450e91
xor eax, eax
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
jmp 0x45276a
lea ecx, [ebp - 0xa198]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x4d3714
call fcn.004a186c
pop ecx
call fcn.0048aa5c
mov dword [ebp - 0x9d84], eax
mov word [ebp - 0x9d70], 0x14
mov eax, dword [edi]
mov dword [ebp - 0x5314], eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x5310], edx
mov cl, byte [edi + 8]
mov byte [ebp - 0x530c], cl
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x5308], eax
push esi
push edi
lea esi, [edi + 0x10]
lea edi, [ebp - 0x5304]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x410]
lea edi, [ebp - 0x4f04]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x810]
lea edi, [ebp - 0x4b04]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0xc10]
lea edi, [ebp - 0x4704]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1410]
lea edi, [ebp - 0x3f04]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x1810]
mov dword [ebp - 0x3b04], eax
mov edx, dword [edi + 0x1814]
mov dword [ebp - 0x3b00], edx
push esi
push edi
lea esi, [edi + 0x1818]
lea edi, [ebp - 0x3afc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1c18]
lea edi, [ebp - 0x36fc]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2418]
lea edi, [ebp - 0x2efc]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x2498]
mov byte [ebp - 0x2e7c], al
push esi
push edi
lea esi, [edi + 0x2499]
lea edi, [ebp - 0x2e7b]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x289c]
mov dword [ebp - 0x2a78], eax
mov dl, byte [edi + 0x28a0]
mov byte [ebp - 0x2a74], dl
mov ecx, dword [edi + 0x28a4]
mov dword [ebp - 0x2a70], ecx
mov eax, dword [edi + 0x28a8]
mov dword [ebp - 0x2a6c], eax
mov edx, dword [edi + 0x28ac]
mov dword [ebp - 0x2a68], edx
mov ecx, dword [edi + 0x28b0]
mov dword [ebp - 0x2a64], ecx
mov al, byte [edi + 0x28b4]
mov byte [ebp - 0x2a60], al
mov dl, byte [edi + 0x28b5]
mov byte [ebp - 0x2a5f], dl
mov cl, byte [edi + 0x28b6]
mov byte [ebp - 0x2a5e], cl
mov eax, dword [edi + 0x28b8]
mov dword [ebp - 0x2a5c], eax
mov edx, dword [edi + 0x28bc]
mov dword [ebp - 0x2a58], edx
mov cl, byte [edi + 0x28c0]
mov byte [ebp - 0x2a54], cl
mov al, byte [edi + 0x28c1]
mov byte [ebp - 0x2a53], al
mov dl, byte [edi + 0x28c2]
mov byte [ebp - 0x2a52], dl
mov cl, byte [edi + 0x28c3]
mov byte [ebp - 0x2a51], cl
mov al, byte [edi + 0x28c4]
mov byte [ebp - 0x2a50], al
mov dl, byte [edi + 0x28c5]
mov byte [ebp - 0x2a4f], dl
mov ecx, dword [edi + 0x28c8]
mov dword [ebp - 0x2a4c], ecx
mov eax, dword [edi + 0x28cc]
mov dword [ebp - 0x2a48], eax
mov edx, dword [edi + 0x28d0]
mov dword [ebp - 0x2a44], edx
mov edx, dword [edi + 0x28d4]
mov dword [ebp - 0x2a40], edx
mov ecx, dword [edi + 0x28d8]
mov dword [ebp - 0x2a3c], ecx
mov eax, dword [edi + 0x28dc]
mov dword [ebp - 0x2a38], eax
mov edx, dword [edi + 0x28e0]
mov dword [ebp - 0x2a34], edx
inc dword [ebp - 0x9d64]
mov ecx, dword [edi + 0x28e4]
mov dword [ebp - 0x2a30], ecx
mov al, byte [edi + 0x28e8]
mov byte [ebp - 0x2a2c], al
mov dl, byte [edi + 0x28e9]
mov byte [ebp - 0x2a2b], dl
mov cl, byte [edi + 0x28ea]
mov byte [ebp - 0x2a2a], cl
mov eax, dword [edi + 0x28ec]
mov dword [ebp - 0x2a28], eax
mov edx, dword [edi + 0x28f0]
mov dword [ebp - 0x2a24], edx
mov cl, byte [edi + 0x28f4]
mov byte [ebp - 0x2a20], cl
mov al, byte [edi + 0x28f5]
mov byte [ebp - 0x2a1f], al
mov edx, dword [edi + 0x28f8]
mov dword [ebp - 0x2a1c], edx
mov ecx, dword [edi + 0x28fc]
mov dword [ebp - 0x2a18], ecx
mov al, byte [edi + 0x2900]
mov byte [ebp - 0x2a14], al
mov dl, byte [edi + 0x2901]
mov byte [ebp - 0x2a13], dl
mov cl, byte [edi + 0x2902]
mov byte [ebp - 0x2a12], cl
mov al, byte [edi + 0x2903]
mov byte [ebp - 0x2a11], al
mov dl, byte [edi + 0x2904]
mov byte [ebp - 0x2a10], dl
mov cl, byte [edi + 0x2905]
mov byte [ebp - 0x2a0f], cl
mov al, byte [edi + 0x2906]
mov byte [ebp - 0x2a0e], al
mov dl, byte [edi + 0x2907]
mov byte [ebp - 0x2a0d], dl
mov cl, byte [edi + 0x2908]
mov byte [ebp - 0x2a0c], cl
push esi
push edi
lea esi, [edi + 0x2909]
lea edi, [ebp - 0x2a0b]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x2959]
mov byte [ebp - 0x29bb], al
mov dl, byte [edi + 0x295a]
mov byte [ebp - 0x29ba], dl
mov cl, byte [edi + 0x295b]
mov byte [ebp - 0x29b9], cl
mov eax, dword [edi + 0x295c]
mov dword [ebp - 0x29b8], eax
mov edx, dword [edi + 0x2960]
mov dword [ebp - 0x29b4], edx
push esi
push edi
lea esi, [edi + 0x2964]
lea edi, [ebp - 0x29b0]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2988]
mov dword [ebp - 0x298c], eax
mov eax, dword [edi + 0x298c]
mov dword [ebp - 0x2988], eax
push esi
push edi
lea esi, [edi + 0x2990]
lea edi, [ebp - 0x2984]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x29b4]
mov dword [ebp - 0x2960], eax
mov eax, dword [edi + 0x29b8]
mov dword [ebp - 0x295c], eax
mov edx, dword [edi + 0x29bc]
mov dword [ebp - 0x2958], edx
mov edx, dword [edi + 0x29c0]
mov dword [ebp - 0x2954], edx
mov ecx, dword [edi + 0x29c4]
mov dword [ebp - 0x2950], ecx
mov ecx, dword [edi + 0x29c8]
mov dword [ebp - 0x294c], ecx
mov al, byte [edi + 0x29cc]
mov byte [ebp - 0x2948], al
mov dl, byte [edi + 0x29cd]
mov byte [ebp - 0x2947], dl
mov cl, byte [edi + 0x29ce]
mov byte [ebp - 0x2946], cl
mov al, byte [edi + 0x29cf]
mov byte [ebp - 0x2945], al
push esi
push edi
lea esi, [edi + 0x29d0]
lea edi, [ebp - 0x2944]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2a90]
lea edi, [ebp - 0x2884]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2e90]
mov dword [ebp - 0x2484], eax
mov dl, byte [edi + 0x2e94]
mov byte [ebp - 0x2480], dl
mov cl, byte [edi + 0x2e95]
mov byte [ebp - 0x247f], cl
mov al, byte [edi + 0x2e96]
mov byte [ebp - 0x247e], al
mov edx, dword [edi + 0x2e98]
mov dword [ebp - 0x247c], edx
mov ecx, dword [edi + 0x2e9c]
mov dword [ebp - 0x2478], ecx
mov ecx, 0x100
mov eax, dword [edi + 0x2ea0]
mov dword [ebp - 0x2474], eax
mov edx, dword [edi + 0x2ea4]
mov dword [ebp - 0x2470], edx
push esi
push edi
lea esi, [edi + 0x2ea8]
lea edi, [ebp - 0x246c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x32a8]
mov dword [ebp - 0x206c], eax
mov dl, byte [edi + 0x32ac]
mov byte [ebp - 0x2068], dl
mov cl, byte [edi + 0x32ad]
mov byte [ebp - 0x2067], cl
mov al, byte [edi + 0x32ae]
mov byte [ebp - 0x2066], al
mov edx, dword [edi + 0x32b0]
mov dword [ebp - 0x2064], edx
mov cl, byte [edi + 0x32b4]
mov byte [ebp - 0x2060], cl
push esi
push edi
lea esi, [edi + 0x32b5]
lea edi, [ebp - 0x205f]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x36b5]
lea edi, [ebp - 0x1c5f]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x3ab5]
mov byte [ebp - 0x185f], al
mov dl, byte [edi + 0x3ab6]
mov byte [ebp - 0x185e], dl
mov cl, byte [edi + 0x3ab7]
mov byte [ebp - 0x185d], cl
mov al, byte [edi + 0x3ab8]
mov byte [ebp - 0x185c], al
mov edx, dword [edi + 0x3abc]
mov dword [ebp - 0x1858], edx
mov cl, byte [edi + 0x3ac0]
mov byte [ebp - 0x1854], cl
mov al, byte [edi + 0x3ac1]
mov byte [ebp - 0x1853], al
mov edx, dword [edi + 0x3ac4]
mov dword [ebp - 0x1850], edx
mov cl, byte [edi + 0x3ac8]
mov byte [ebp - 0x184c], cl
inc dword [ebp - 0x9d64]
mov al, byte [edi + 0x3acc]
mov byte [ebp - 0x1848], al
mov dl, byte [edi + 0x3acd]
mov byte [ebp - 0x1847], dl
mov cl, byte [edi + 0x3ace]
mov byte [ebp - 0x1846], cl
mov ecx, 0x104
mov al, byte [edi + 0x3acf]
mov byte [ebp - 0x1845], al
push esi
push edi
lea esi, [edi + 0x3ad0]
lea edi, [ebp - 0x1844]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x3ee0]
lea edi, [ebp - 0x1434]
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x4700]
lea edi, [ebp - 0xc14]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x4b00]
lea edi, [ebp - 0x814]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x5300]
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [edi + 0x5304]
mov dword [ebp - 0x10], edx
mov ecx, dword [edi + 0x5308]
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x530c]
mov dword [ebp - 8], eax
lea eax, [edi + 0x28d8]
mov edx, dword [edi + 0x5310]
mov dword [ebp - 4], edx
lea edx, [ebx + 0x28d8]
inc dword [ebp - 0x9d64]
mov word [ebp - 0x9d70], 8
call fcn.0040eb78
lea ecx, [ebx + 0x2964]
mov dword [ebp - 0x9d88], ecx
mov ecx, 9
mov eax, dword [ebp - 0x9d88]
push esi
push edi
mov esi, eax
add edi, 0x2964
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9d88]
pop edi
pop esi
lea ecx, [ebx + 0x2990]
mov edx, dword [eax + 0x24]
mov dword [edi + 0x2988], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x298c], edx
mov dword [ebp - 0x9d8c], ecx
mov eax, dword [ebp - 0x9d8c]
push esi
push edi
mov esi, eax
add edi, 0x2990
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9d8c]
pop edi
pop esi
mov edx, dword [eax + 0x24]
mov dword [edi + 0x29b4], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x29b8], edx
mov ecx, dword [ebx]
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dl, byte [ebx + 8]
mov byte [edi + 8], dl
mov ecx, dword [ebx + 0xc]
mov dword [edi + 0xc], ecx
push esi
push edi
lea esi, [ebx + 0x10]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x410]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x810]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0xc10]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1410]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x1810]
pop esi
mov ecx, 0x100
mov dword [edi + 0x1810], eax
mov edx, dword [ebx + 0x1814]
mov dword [edi + 0x1814], edx
push esi
push edi
lea esi, [ebx + 0x1818]
add edi, 0x1818
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1c18]
add edi, 0x1c18
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2418]
add edi, 0x2418
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x2498]
mov ecx, 0x100
mov byte [edi + 0x2498], al
push esi
push edi
lea esi, [ebx + 0x2499]
add edi, 0x2499
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x289c]
mov dword [edi + 0x289c], eax
mov dl, byte [ebx + 0x28a0]
mov byte [edi + 0x28a0], dl
mov ecx, dword [ebx + 0x28a4]
mov dword [edi + 0x28a4], ecx
mov eax, dword [ebx + 0x28a8]
mov dword [edi + 0x28a8], eax
mov edx, dword [ebx + 0x28ac]
mov dword [edi + 0x28ac], edx
mov ecx, dword [ebx + 0x28b0]
mov dword [edi + 0x28b0], ecx
mov al, byte [ebx + 0x28b4]
mov byte [edi + 0x28b4], al
mov dl, byte [ebx + 0x28b5]
mov byte [edi + 0x28b5], dl
mov cl, byte [ebx + 0x28b6]
mov byte [edi + 0x28b6], cl
mov eax, dword [ebx + 0x28b8]
mov dword [edi + 0x28b8], eax
mov edx, dword [ebx + 0x28bc]
mov dword [edi + 0x28bc], edx
mov cl, byte [ebx + 0x28c0]
mov byte [edi + 0x28c0], cl
mov al, byte [ebx + 0x28c1]
mov byte [edi + 0x28c1], al
mov dl, byte [ebx + 0x28c2]
mov byte [edi + 0x28c2], dl
mov cl, byte [ebx + 0x28c3]
mov byte [edi + 0x28c3], cl
mov al, byte [ebx + 0x28c4]
mov byte [edi + 0x28c4], al
mov dl, byte [ebx + 0x28c5]
mov byte [edi + 0x28c5], dl
mov ecx, dword [ebx + 0x28c8]
mov dword [edi + 0x28c8], ecx
mov eax, dword [ebx + 0x28cc]
mov dword [edi + 0x28cc], eax
mov edx, dword [ebx + 0x28d0]
mov dword [edi + 0x28d0], edx
mov edx, dword [ebx + 0x28d4]
mov dword [edi + 0x28d4], edx
mov ecx, dword [ebx + 0x28e4]
mov dword [edi + 0x28e4], ecx
mov al, byte [ebx + 0x28e8]
mov byte [edi + 0x28e8], al
mov dl, byte [ebx + 0x28e9]
mov byte [edi + 0x28e9], dl
mov cl, byte [ebx + 0x28ea]
mov byte [edi + 0x28ea], cl
mov eax, dword [ebx + 0x28ec]
mov dword [edi + 0x28ec], eax
mov edx, dword [ebx + 0x28f0]
mov dword [edi + 0x28f0], edx
mov cl, byte [ebx + 0x28f4]
mov byte [edi + 0x28f4], cl
mov al, byte [ebx + 0x28f5]
mov byte [edi + 0x28f5], al
mov edx, dword [ebx + 0x28f8]
mov dword [edi + 0x28f8], edx
mov ecx, dword [ebx + 0x28fc]
mov dword [edi + 0x28fc], ecx
mov al, byte [ebx + 0x2900]
mov byte [edi + 0x2900], al
mov dl, byte [ebx + 0x2901]
mov byte [edi + 0x2901], dl
mov cl, byte [ebx + 0x2902]
mov byte [edi + 0x2902], cl
mov al, byte [ebx + 0x2903]
mov byte [edi + 0x2903], al
mov dl, byte [ebx + 0x2904]
mov byte [edi + 0x2904], dl
mov cl, byte [ebx + 0x2905]
mov byte [edi + 0x2905], cl
mov al, byte [ebx + 0x2906]
mov byte [edi + 0x2906], al
mov dl, byte [ebx + 0x2907]
mov byte [edi + 0x2907], dl
mov cl, byte [ebx + 0x2908]
mov byte [edi + 0x2908], cl
push esi
push edi
lea esi, [ebx + 0x2909]
add edi, 0x2909
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x2959]
mov byte [edi + 0x2959], al
mov dl, byte [ebx + 0x295a]
mov byte [edi + 0x295a], dl
mov cl, byte [ebx + 0x295b]
mov byte [edi + 0x295b], cl
mov eax, dword [ebx + 0x295c]
mov dword [edi + 0x295c], eax
mov edx, dword [ebx + 0x2960]
mov dword [edi + 0x2960], edx
mov ecx, dword [ebx + 0x29bc]
mov dword [edi + 0x29bc], ecx
mov ecx, dword [ebx + 0x29c0]
mov dword [edi + 0x29c0], ecx
mov eax, dword [ebx + 0x29c4]
mov dword [edi + 0x29c4], eax
mov eax, dword [ebx + 0x29c8]
mov dword [edi + 0x29c8], eax
mov dl, byte [ebx + 0x29cc]
mov byte [edi + 0x29cc], dl
mov cl, byte [ebx + 0x29cd]
mov byte [edi + 0x29cd], cl
mov ecx, 0x30
mov al, byte [ebx + 0x29ce]
mov byte [edi + 0x29ce], al
mov dl, byte [ebx + 0x29cf]
mov byte [edi + 0x29cf], dl
push esi
push edi
lea esi, [ebx + 0x29d0]
add edi, 0x29d0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2a90]
add edi, 0x2a90
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2e90]
pop esi
mov dword [edi + 0x2e90], eax
mov dl, byte [ebx + 0x2e94]
mov byte [edi + 0x2e94], dl
mov cl, byte [ebx + 0x2e95]
mov byte [edi + 0x2e95], cl
mov al, byte [ebx + 0x2e96]
mov byte [edi + 0x2e96], al
mov edx, dword [ebx + 0x2e98]
mov dword [edi + 0x2e98], edx
mov ecx, dword [ebx + 0x2e9c]
mov dword [edi + 0x2e9c], ecx
mov ecx, 0x100
mov eax, dword [ebx + 0x2ea0]
mov dword [edi + 0x2ea0], eax
mov edx, dword [ebx + 0x2ea4]
mov dword [edi + 0x2ea4], edx
push esi
push edi
lea esi, [ebx + 0x2ea8]
add edi, 0x2ea8
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x32a8]
pop esi
mov dword [edi + 0x32a8], eax
mov dl, byte [ebx + 0x32ac]
mov byte [edi + 0x32ac], dl
mov cl, byte [ebx + 0x32ad]
mov byte [edi + 0x32ad], cl
mov al, byte [ebx + 0x32ae]
mov byte [edi + 0x32ae], al
mov edx, dword [ebx + 0x32b0]
mov dword [edi + 0x32b0], edx
mov cl, byte [ebx + 0x32b4]
mov byte [edi + 0x32b4], cl
push esi
push edi
lea esi, [ebx + 0x32b5]
add edi, 0x32b5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x36b5]
add edi, 0x36b5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov al, byte [ebx + 0x3ab5]
pop esi
mov byte [edi + 0x3ab5], al
mov dl, byte [ebx + 0x3ab6]
mov byte [edi + 0x3ab6], dl
mov cl, byte [ebx + 0x3ab7]
mov byte [edi + 0x3ab7], cl
mov al, byte [ebx + 0x3ab8]
mov byte [edi + 0x3ab8], al
mov edx, dword [ebx + 0x3abc]
mov dword [edi + 0x3abc], edx
mov cl, byte [ebx + 0x3ac0]
mov byte [edi + 0x3ac0], cl
mov al, byte [ebx + 0x3ac1]
mov byte [edi + 0x3ac1], al
mov edx, dword [ebx + 0x3ac4]
mov dword [edi + 0x3ac4], edx
mov cl, byte [ebx + 0x3ac8]
mov byte [edi + 0x3ac8], cl
mov al, byte [ebx + 0x3acc]
mov byte [edi + 0x3acc], al
mov dl, byte [ebx + 0x3acd]
mov byte [edi + 0x3acd], dl
mov cl, byte [ebx + 0x3ace]
mov byte [edi + 0x3ace], cl
mov ecx, 0x104
mov al, byte [ebx + 0x3acf]
mov byte [edi + 0x3acf], al
push esi
push edi
lea esi, [ebx + 0x3ad0]
add edi, 0x3ad0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x3ee0]
add edi, 0x3ee0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x4700]
add edi, 0x4700
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x4b00]
add edi, 0x4b00
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x5300]
mov dword [edi + 0x5300], eax
mov edx, dword [ebx + 0x5304]
mov dword [edi + 0x5304], edx
mov ecx, dword [ebx + 0x5308]
mov dword [edi + 0x5308], ecx
xor ecx, ecx
mov eax, dword [ebx + 0x530c]
mov dword [edi + 0x530c], eax
mov eax, 0x4d0b94
mov edx, dword [ebx + 0x5310]
mov dword [edi + 0x5310], edx
xor edx, edx
call fcn.00454664
lea edx, [ebp - 0x2a3c]
lea eax, [edi + 0x28d8]
call fcn.0040eb78
push esi
push edi
lea esi, [ebp - 0x29b0]
add edi, 0x2964
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x298c]
mov dword [edi + 0x2988], eax
mov eax, dword [ebp - 0x2988]
mov dword [edi + 0x298c], eax
push esi
push edi
lea esi, [ebp - 0x2984]
add edi, 0x2990
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2960]
mov dword [edi + 0x29b4], eax
mov eax, dword [ebp - 0x295c]
mov dword [edi + 0x29b8], eax
mov edx, dword [ebp - 0x5314]
mov dword [edi], edx
mov ecx, dword [ebp - 0x5310]
mov dword [edi + 4], ecx
mov al, byte [ebp - 0x530c]
mov byte [edi + 8], al
mov edx, dword [ebp - 0x5308]
mov dword [edi + 0xc], edx
push esi
push edi
lea esi, [ebp - 0x5304]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x4f04]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x4b04]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x4704]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x3f04]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x3b04]
mov dword [edi + 0x1810], eax
mov edx, dword [ebp - 0x3b00]
mov dword [edi + 0x1814], edx
push esi
push edi
lea esi, [ebp - 0x3afc]
add edi, 0x1818
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x36fc]
add edi, 0x1c18
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2efc]
add edi, 0x2418
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x2e7c]
mov byte [edi + 0x2498], al
push esi
push edi
lea esi, [ebp - 0x2e7b]
add edi, 0x2499
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2a78]
mov dword [edi + 0x289c], eax
mov dl, byte [ebp - 0x2a74]
mov byte [edi + 0x28a0], dl
mov ecx, dword [ebp - 0x2a70]
mov dword [edi + 0x28a4], ecx
mov eax, dword [ebp - 0x2a6c]
mov dword [edi + 0x28a8], eax
mov edx, dword [ebp - 0x2a68]
mov dword [edi + 0x28ac], edx
mov ecx, dword [ebp - 0x2a64]
mov dword [edi + 0x28b0], ecx
mov al, byte [ebp - 0x2a60]
mov byte [edi + 0x28b4], al
mov dl, byte [ebp - 0x2a5f]
mov byte [edi + 0x28b5], dl
mov cl, byte [ebp - 0x2a5e]
mov byte [edi + 0x28b6], cl
mov eax, dword [ebp - 0x2a5c]
mov dword [edi + 0x28b8], eax
mov edx, dword [ebp - 0x2a58]
mov dword [edi + 0x28bc], edx
mov cl, byte [ebp - 0x2a54]
mov byte [edi + 0x28c0], cl
mov al, byte [ebp - 0x2a53]
mov byte [edi + 0x28c1], al
mov dl, byte [ebp - 0x2a52]
mov byte [edi + 0x28c2], dl
mov cl, byte [ebp - 0x2a51]
mov byte [edi + 0x28c3], cl
mov al, byte [ebp - 0x2a50]
mov byte [edi + 0x28c4], al
mov dl, byte [ebp - 0x2a4f]
mov byte [edi + 0x28c5], dl
mov ecx, dword [ebp - 0x2a4c]
mov dword [edi + 0x28c8], ecx
mov eax, dword [ebp - 0x2a48]
mov dword [edi + 0x28cc], eax
mov edx, dword [ebp - 0x2a44]
mov dword [edi + 0x28d0], edx
mov edx, dword [ebp - 0x2a40]
mov dword [edi + 0x28d4], edx
mov ecx, dword [ebp - 0x2a30]
mov dword [edi + 0x28e4], ecx
mov al, byte [ebp - 0x2a2c]
mov byte [edi + 0x28e8], al
mov dl, byte [ebp - 0x2a2b]
mov byte [edi + 0x28e9], dl
mov cl, byte [ebp - 0x2a2a]
mov byte [edi + 0x28ea], cl
mov eax, dword [ebp - 0x2a28]
mov dword [edi + 0x28ec], eax
mov edx, dword [ebp - 0x2a24]
mov dword [edi + 0x28f0], edx
mov cl, byte [ebp - 0x2a20]
mov byte [edi + 0x28f4], cl
mov al, byte [ebp - 0x2a1f]
mov byte [edi + 0x28f5], al
mov edx, dword [ebp - 0x2a1c]
mov dword [edi + 0x28f8], edx
mov ecx, dword [ebp - 0x2a18]
mov dword [edi + 0x28fc], ecx
mov al, byte [ebp - 0x2a14]
mov byte [edi + 0x2900], al
mov dl, byte [ebp - 0x2a13]
mov byte [edi + 0x2901], dl
mov cl, byte [ebp - 0x2a12]
mov byte [edi + 0x2902], cl
mov al, byte [ebp - 0x2a11]
mov byte [edi + 0x2903], al
mov dl, byte [ebp - 0x2a10]
mov byte [edi + 0x2904], dl
mov cl, byte [ebp - 0x2a0f]
mov byte [edi + 0x2905], cl
mov al, byte [ebp - 0x2a0e]
mov byte [edi + 0x2906], al
mov dl, byte [ebp - 0x2a0d]
mov byte [edi + 0x2907], dl
mov cl, byte [ebp - 0x2a0c]
mov byte [edi + 0x2908], cl
push esi
push edi
lea esi, [ebp - 0x2a0b]
add edi, 0x2909
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x29bb]
mov byte [edi + 0x2959], al
mov dl, byte [ebp - 0x29ba]
mov byte [edi + 0x295a], dl
mov cl, byte [ebp - 0x29b9]
mov byte [edi + 0x295b], cl
mov eax, dword [ebp - 0x29b8]
mov dword [edi + 0x295c], eax
mov edx, dword [ebp - 0x29b4]
mov dword [edi + 0x2960], edx
mov ecx, dword [ebp - 0x2958]
mov dword [edi + 0x29bc], ecx
mov ecx, dword [ebp - 0x2954]
mov dword [edi + 0x29c0], ecx
mov eax, dword [ebp - 0x2950]
mov dword [edi + 0x29c4], eax
mov eax, dword [ebp - 0x294c]
mov dword [edi + 0x29c8], eax
mov dl, byte [ebp - 0x2948]
mov byte [edi + 0x29cc], dl
mov cl, byte [ebp - 0x2947]
mov byte [edi + 0x29cd], cl
mov al, byte [ebp - 0x2946]
mov byte [edi + 0x29ce], al
mov dl, byte [ebp - 0x2945]
mov byte [edi + 0x29cf], dl
push esi
push edi
lea esi, [ebp - 0x2944]
add edi, 0x29d0
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2884]
add edi, 0x2a90
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2484]
mov dword [edi + 0x2e90], eax
mov dl, byte [ebp - 0x2480]
mov byte [edi + 0x2e94], dl
mov cl, byte [ebp - 0x247f]
mov byte [edi + 0x2e95], cl
mov al, byte [ebp - 0x247e]
mov byte [edi + 0x2e96], al
mov edx, dword [ebp - 0x247c]
mov dword [edi + 0x2e98], edx
mov ecx, dword [ebp - 0x2478]
mov dword [edi + 0x2e9c], ecx
mov eax, dword [ebp - 0x2474]
mov dword [edi + 0x2ea0], eax
mov edx, dword [ebp - 0x2470]
mov dword [edi + 0x2ea4], edx
push esi
push edi
lea esi, [ebp - 0x246c]
add edi, 0x2ea8
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x206c]
mov dword [edi + 0x32a8], eax
mov dl, byte [ebp - 0x2068]
mov byte [edi + 0x32ac], dl
mov cl, byte [ebp - 0x2067]
mov byte [edi + 0x32ad], cl
mov al, byte [ebp - 0x2066]
mov byte [edi + 0x32ae], al
mov edx, dword [ebp - 0x2064]
mov dword [edi + 0x32b0], edx
mov cl, byte [ebp - 0x2060]
mov byte [edi + 0x32b4], cl
push esi
push edi
lea esi, [ebp - 0x205f]
add edi, 0x32b5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1c5f]
add edi, 0x36b5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x185f]
mov byte [edi + 0x3ab5], al
mov dl, byte [ebp - 0x185e]
mov byte [edi + 0x3ab6], dl
mov cl, byte [ebp - 0x185d]
mov byte [edi + 0x3ab7], cl
mov al, byte [ebp - 0x185c]
mov byte [edi + 0x3ab8], al
mov edx, dword [ebp - 0x1858]
mov dword [edi + 0x3abc], edx
mov cl, byte [ebp - 0x1854]
mov byte [edi + 0x3ac0], cl
mov al, byte [ebp - 0x1853]
mov byte [edi + 0x3ac1], al
mov edx, dword [ebp - 0x1850]
mov dword [edi + 0x3ac4], edx
mov cl, byte [ebp - 0x184c]
mov byte [edi + 0x3ac8], cl
mov al, byte [ebp - 0x1848]
mov byte [edi + 0x3acc], al
mov dl, byte [ebp - 0x1847]
mov byte [edi + 0x3acd], dl
mov cl, byte [ebp - 0x1846]
mov byte [edi + 0x3ace], cl
mov al, byte [ebp - 0x1845]
mov byte [edi + 0x3acf], al
push esi
push edi
lea esi, [ebp - 0x1844]
add edi, 0x3ad0
mov ecx, 0x104
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1434]
add edi, 0x3ee0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0xc14]
add edi, 0x4700
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x814]
add edi, 0x4b00
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x5300], eax
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x5304], edx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x5308], ecx
mov eax, dword [ebp - 8]
mov dword [edi + 0x530c], eax
mov edx, dword [ebp - 4]
mov dword [edi + 0x5310], edx
push 0x5314
push 0
lea ecx, [ebp - 0x5314]
push ecx
call fcn.0049fc54
add esp, 0xc
call fcn.0048aa5c
cmp eax, dword [ebp - 0x9d84]
jne 0x452246
cmp dword [0x4d27e8], 0
je 0x45224a
xor eax, eax
jmp 0x45224f
mov eax, 1
test al, al
jne 0x45225a
mov byte [0x4d3712], 0
cmp byte [esi + 0x5320], 0
je 0x452296
lea edx, [ebp - 0xa598]
lea eax, [esi + 0x5320]
call fcn.0040c608
lea edx, [ebp - 0xad98]
lea eax, [esi + 0x5720]
call fcn.0040c738
lea edx, [ebp - 0xad98]
lea eax, [ebp - 0xa598]
call fcn.00466ee0
call fcn.0041113c
test eax, eax
setne dl
and edx, 1
mov dword [ebp - 0x9d94], edx
mov word [ebp - 0x9d70], 0x20
lea eax, [ebp - 0x540c]
call fcn.00410634
add dword [ebp - 0x9d64], 4
mov word [ebp - 0x9d70], 8
mov word [ebp - 0x9d70], 0x2c
mov word [ebp - 0x9d70], 0x38
lea eax, [ebp - 0x5504]
call fcn.00410634
add dword [ebp - 0x9d64], 4
mov word [ebp - 0x9d70], 0x44
mov edx, 0x4b106d
lea eax, [ebp - 0x5504]
call fcn.004107b8
lea eax, [ebp - 0xb23c]
call fcn.00414bf8
lea eax, [ebp - 0xb210]
call fcn.00414bf8
lea eax, [ebp - 0xb1e4]
call fcn.00414bf8
mov word [ebp - 0x9d70], 0x50
push 0
push 3
lea edx, [ebp - 0x5504]
lea eax, [ebp - 0x7930]
xor ecx, ecx
call fcn.0041408c
inc dword [ebp - 0x9d64]
xor ebx, ebx
mov word [ebp - 0x9d70], 0x44
xor edi, edi
jmp 0x4523d4
lea edx, [ebp - 0xc250]
lea eax, [ebp - 0xbe50]
call fcn.0040adf8
lea ecx, [ebp - 0xba50]
lea edx, [ebp - 0xba50]
lea eax, [ebp - 0xbe50]
call fcn.0040dd30
lea edx, [ebp - 0xca50]
lea eax, [ebp - 0xba50]
call fcn.0040ae48
lea ecx, [ebp - 0xca50]
lea edx, [ebp - 0xc250]
lea eax, [ebp - 0x540c]
call fcn.004107c0
lea ecx, [ebp - 0xc250]
push ecx
call fcn.0049fe04
pop ecx
add eax, ebx
add eax, 3
mov ebx, eax
lea eax, [ebp - 0xca50]
call fcn.00411474
add eax, 3
add edi, eax
lea edx, [ebp - 0xbe50]
lea eax, [ebp - 0x7930]
call fcn.004141cc
test eax, eax
je 0x452360
test ebx, ebx
jne 0x452462
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7930]
dec dword [ebp - 0x9d64]
call fcn.0041416c
sub dword [ebp - 0x9d64], 4
lea eax, [ebp - 0x5504]
mov edx, 2
call fcn.0041070c
sub dword [ebp - 0x9d64], 4
lea eax, [ebp - 0x540c]
mov edx, 2
call fcn.0041070c
sub dword [ebp - 0x9d64], 3
lea eax, [ebp - 0x5314]
mov edx, 2
call fcn.004275dc
pop eax
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
jmp 0x45276a
cmp dword [ebp - 0x9d94], 0
je 0x45246f
mov ebx, edi
add ebx, ebx
add ebx, 0x15
push ebx
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x9d90], eax
cmp dword [ebp - 0x9d90], 0
jne 0x4524fd
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7930]
dec dword [ebp - 0x9d64]
call fcn.0041416c
sub dword [ebp - 0x9d64], 4
lea eax, [ebp - 0x5504]
mov edx, 2
call fcn.0041070c
sub dword [ebp - 0x9d64], 4
lea eax, [ebp - 0x540c]
mov edx, 2
call fcn.0041070c
sub dword [ebp - 0x9d64], 3
lea eax, [ebp - 0x5314]
mov edx, 2
call fcn.004275dc
pop eax
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
jmp 0x45276a
lea eax, [ebp - 0x5504]
call fcn.0041099c
mov word [ebp - 0x9d70], 0x5c
push 0
push 1
lea edx, [ebp - 0x5504]
lea eax, [ebp - 0x9d5c]
mov ecx, 1
call fcn.0041408c
inc dword [ebp - 0x9d64]
mov word [ebp - 0x9d70], 0x44
jmp 0x45254e
test byte [ebp - 0xb248], 5
je 0x45254e
mov byte [esi + 0x5f21], 0
jmp 0x452563
lea edx, [ebp - 0xbe50]
lea eax, [ebp - 0x9d5c]
call fcn.004141cc
test eax, eax
je 0x45253c
dec dword [ebp - 0x9d64]
lea eax, [ebp - 0x9d5c]
mov edx, 2
call fcn.0041416c
dec dword [ebp - 0x9d64]
lea eax, [ebp - 0x7930]
mov edx, 2
call fcn.0041416c
sub dword [ebp - 0x9d64], 4
lea eax, [ebp - 0x5504]
mov edx, 2
call fcn.0041070c
mov word [ebp - 0x9d70], 0x2c
mov word [ebp - 0x9d70], 8
jmp 0x452616
push dword [ebp - 0x9d90]
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x9d98], eax
mov word [ebp - 0x9d70], 8
mov edx, dword [ebp - 0x9d98]
mov dword [edx], 0x14
mov ecx, dword [ebp - 0x9d98]
mov eax, dword [ebp - 0x9d94]
mov dword [ecx + 0x10], eax
xor ebx, ebx
mov edi, dword [ebp - 0x9d98]
add edi, 0x14
jmp 0x4526a1
cmp dword [ebp - 0x9d94], 0
je 0x45267f
lea edx, [ebp - 0xd650]
lea eax, [edi + ebx*2]
call fcn.00411488
lea eax, [ebp - 0xd650]
call fcn.00411474
inc eax
add ebx, eax
jmp 0x4526a1
lea edx, [ebp - 0xce50]
push edx
lea ecx, [ebx + edi]
push ecx
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0xce50]
push eax
call fcn.0049fe04
pop ecx
add eax, ebx
inc eax
mov ebx, eax
push 0x400
lea ecx, [ebp - 0xd650]
lea edx, [ebp - 0xce50]
lea eax, [ebp - 0x540c]
call fcn.0041085c
test al, al
jne 0x452658
cmp dword [ebp - 0x9d94], 0
je 0x4526d2
mov word [edi + ebx*2], 0
jmp 0x4526d6
mov byte [edi + ebx], 0
lea edx, [ebp - 0xa198]
push edx
call fcn.004a186c
pop ecx
push dword [ebp - 0x9d90]
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov word [ebp - 0x9d70], 8
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x45271c
push ebx
push dword [ebp - 0x9d98]
push dword [esi + 8]
call fcn.0049fbe4
add esp, 0xc
push dword [ebp - 0x9d90]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 0x9d90]
mov edx, 2
push eax
lea eax, [ebp - 0x540c]
sub dword [ebp - 0x9d64], 4
call fcn.0041070c
sub dword [ebp - 0x9d64], 3
lea eax, [ebp - 0x5314]
mov edx, 2
call fcn.004275dc
pop eax
mov edx, dword [ebp - 0x9d80]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret