Function at 0x4adbf0
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file
Parse pe header
Query environment variable

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x490
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_SetErrorMode]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x460], 0
sub esp, 4
jmp 0x4ae6e6
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3a3
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3a6
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], str._lx___SEC_IMAGE_n
cmp eax, 0x1000000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
mov esi, dword fs:[0x18]
call fcn.0049fda0
mov dword [esi + 0x34], 0xdeadbeef
mov eax, dword [ebp - 0x204]
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], eax
mov eax, dword [0x79ea48]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3aa
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.VirtualAlloc_should_fail_n
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3ab
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5d400c
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esi + 0x34], 5
sete al
mov dword [esp], eax
call fcn.0049fda0
lea eax, [ebp - 0x218]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20c]
add eax, edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3af
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5d5ab4
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0x1c
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [0x79ea48]
je 0x4aea40
cmp eax, dword [ebp - 0x3d8]
je 0x4aea40
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3be
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3bf
mov eax, dword [ebp - 0x218]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], 0x5d5acc
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c0
mov eax, dword [ebp - 0x214]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], 0x5d5b19
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c1
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c2
mov eax, dword [ebp - 0x464]
lea eax, [edx + eax - 1]
neg edx
and eax, edx
mov edx, dword [ebp - 0x20c]
mov dword [esp + 4], 0x5d606b
mov dword [esp + 0xc], eax
cmp eax, edx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c4
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], 0x5d6083
cmp eax, 0x1000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c5
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], 0x5d6096
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3c6
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], str._lx___SEC_IMAGE_n
cmp eax, 0x1000000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jae 0x4aeba8
cmp word [ebp - 0x40e], 0
jne 0x4aebfe
lea eax, [ebp - 0x31c]
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [ebp - 0x468], eax
call eax
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x404
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.LoadLibraryEx_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x405
xor eax, eax
cmp edi, esi
sete al
mov dword [esp + 4], str.hlib_as_file_and_hlib_are_different_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], edi
mov dword [ebp - 0x464], eax
call eax
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x409
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.FreeLibrary_error__ld_n
call fcn.0049fda0
lea ecx, [ebp - 0x31c]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], ecx
mov ecx, dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [ebp - 0x46c], ecx
call ecx
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x40d
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.GetModuleHandle_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov eax, dword [ebp - 0x464]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x411
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0x31c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.FreeLibrary_error__ld_n
call fcn.0049fda0
mov dword [esp], esi
mov ecx, dword [ebp - 0x46c]
call ecx
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x414
xor eax, eax
test esi, esi
lea esi, [ebp - 0x31c]
sete al
mov dword [esp + 4], str.GetModuleHandle_should_fail_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x468]
call edi
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x418
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.LoadLibraryEx_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, esi
and edx, 3
mov dword [eax], 0x5d3477
cmp edx, 1
mov dword [eax + 4], 0x419
sete al
mov dword [esp + 8], esi
movzx eax, al
mov dword [esp + 4], str.hlib_as_data_file_got__p_n
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x31c]
mov dword [esp], edx
mov ecx, dword [ebp - 0x46c]
call ecx
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x41c
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.GetModuleHandle_should_fail_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, dword [sym.imp.kernel32.dll_CreateFileA]
lea edx, [ebp - 0x31c]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [ebp - 0x47c], ecx
call ecx
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x420
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.open_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0049fda0
mov edx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], edi
mov dword [ebp - 0x478], edx
call edx
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x464]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x425
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0x31c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.FreeLibrary_error__ld_n
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x468]
call edi
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x429
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.LoadLibraryEx_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x31c]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov ecx, dword [ebp - 0x47c]
call ecx
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x42d
xor eax, eax
cmp edi, 0xffffffff
sete al
mov dword [esp + 4], str.open_succeeded_n
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x42e
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], 0x5d591f
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebx + 0x34], 0x20
sete al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov edx, dword [ebp - 0x478]
call edx
lea edx, [ebp - 0x31c]
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 4
mov dword [esp], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80010000
mov ecx, dword [ebp - 0x47c]
call ecx
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x433
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.open_failed_err__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov edx, dword [ebp - 0x478]
call edx
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x464]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x438
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
lea esi, [ebp - 0x31c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.FreeLibrary_error__ld_n
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x468]
call edi
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov edi, esi
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x43c
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.LoadLibraryEx_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
and edi, 3
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
cmp edi, 2
lea edi, [ebp - 0x31c]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x43d
sete al
movzx eax, al
mov dword [esp + 8], esi
mov dword [esp + 4], str.hlib_as_data_file_got__p_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], edi
mov ecx, dword [ebp - 0x46c]
call ecx
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x441
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.GetModuleHandle_should_fail_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], esi
mov eax, dword [ebp - 0x464]
call eax
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x445
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.FreeLibrary_error__ld_n
call fcn.0049fda0
lea eax, [ebp - 0x31c]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x449
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.DeleteFile_error__ld_n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0049fda0
mov eax, dword [ebp - 0x474]
lea ecx, [ebp - 0x31c]
lea edx, [ebp - 0x414]
mov dword [ebp - 0x3ec], 0x12345678
call fcn.004a1f40
test eax, eax
je 0x4af030
mov dword [esp], 0
mov eax, dword [ebp - 0x460]
lea ecx, [ebp - 0x414]
lea edx, [ebp - 0x31c]
call fcn.004a9d10
lea eax, [ebp - 0x31c]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x467
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.DeleteFile_error__ld_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4ae6c9
sub edx, 1
mov dword [eax + 0xbec], edx
add dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x460]
add dword [ebp - 0x470], 0x28
cmp eax, 0x12
je 0x4af070
mov eax, dword [ebp - 0x460]
mov ebx, 4
lea edi, [ebp - 0x40c]
mov dword [esp], 0x5d6033
mov esi, 1
mov dword [esp + 4], eax
call fcn.0049f0a0
mov ecx, 0x14c
xor eax, eax
mov dword [ebp - 0x414], 0x4550
mov word [ebp - 0x410], cx
mov ecx, 0x3c
rep stosd dword es:[edi], eax
mov edi, 4
mov word [ebp - 0x3d4], bx
mov ebx, dword [ebp - 0x470]
lea ecx, [ebp - 0x31c]
mov word [ebp - 0x3d0], si
movzx eax, word [ebx + 0x5d6d84]
mov edx, dword [ebx + 0x5d6d90]
mov word [ebp - 0x3cc], di
lea edi, [ebp - 0x31c]
mov dword [ebp - 0x3fe], 0x10b2002
mov word [ebp - 0x40e], ax
movzx eax, word [ebx + 0x5d6d86]
mov dword [ebp - 0x3c4], edx
lea edx, [ebp - 0x414]
mov word [ebp - 0x400], ax
mov eax, dword [ebx + 0x5d6d88]
mov byte [ebp - 0x3fa], 1
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebx + 0x5d6d8c]
mov dword [ebp - 0x3e8], 0x10
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebx + 0x5d6d94]
mov byte [ebp - 0x3dd], 0x10
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebx + 0x5d6d80]
mov dword [ebp - 0x3b8], 0x1400003
mov dword [ebp - 0x3b2], 0x10000010
mov dword [ebp - 0x3aa], 0x10000010
mov dword [ebp - 0x3a0], 0x10
mov dword [0x57f2e4], 0x40000040
mov dword [ebp - 0x474], eax
call fcn.004a1f40
mov dword [ebp - 0x464], eax
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
mov edi, eax
test eax, eax
je 0x4aef00
call fcn.0057d110
mov edx, dword [ebx + 0x5d6d98]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x396
xor eax, eax
test edx, edx
sete al
mov dword [esp + 4], 0x5d6036
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1c
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x39a
mov eax, dword [esi + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x460]
mov dword [esp + 4], str._d:_VirtualQuery_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0x1c
sete al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x39c
mov eax, dword [ebp - 0x218]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], 0x5d5b19
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x39d
mov eax, dword [ebp - 0x214]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], 0x5d5b19
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x39e
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x39f
mov eax, dword [ebp - 0x3c4]
add eax, edx
neg edx
sub eax, 1
and eax, edx
mov edx, dword [ebp - 0x20c]
mov dword [esp + 4], 0x5d606b
mov dword [esp + 0xc], eax
cmp eax, edx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3a1
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], 0x5d6083
cmp eax, 0x1000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jb 0x4adc30
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3a5
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], 0x5d6096
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4adc67
call fcn.0057d110
mov dword [eax], 0x5d3477
mov edx, dword [0x79ea48]
mov dword [eax + 4], 0x3b3
mov eax, dword [ebp - 0x3c4]
add eax, edx
neg edx
sub eax, 1
and eax, edx
mov edx, dword [ebp - 0x218]
mov dword [esp + 4], 0x5d5acc
add eax, edi
cmp eax, edx
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], edx
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3b5
mov eax, dword [ebp - 0x214]
mov dword [esp + 4], str._p___0_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3b6
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], 0x5d60e1
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3b8
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], 0x5d60eb
cmp eax, 0x10000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3b9
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], 0x5d60e1
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3ba
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], 0x5d60fc
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jb 0x4adf8c
mov esi, dword [ebp - 0x3c0]
add esi, edi
lea ebx, [esi + eax - 1]
neg eax
and ebx, eax
mov eax, 0x3d0
call fcn.0049f440
sub ebx, esi
mov dword [esp + 4], 0x5d7340
mov dword [esp + 8], ebx
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.header_alignment_is_not_cleared_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
cmp word [ebp - 0x40e], 0
je 0x4adf9a
lea eax, [ebp - 0x218]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x57f2cc]
add eax, edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3d7
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5d5ab4
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0x1c
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jae 0x4aef80
mov eax, 0x3db
call fcn.0049f440
mov eax, dword [ebp - 0x218]
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x5d5acc
cmp eax, edi
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3dc
call fcn.0049f440
mov edx, dword [0x79ea48]
mov eax, dword [ebp - 0x3c4]
add eax, edx
neg edx
sub eax, 1
and eax, edx
mov edx, dword [ebp - 0x20c]
mov dword [esp + 4], 0x5d606b
mov dword [esp + 0xc], eax
cmp eax, edx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3de
call fcn.0049f440
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3e7
mov eax, dword [ebp - 0x214]
mov dword [esp + 0xc], edi
cmp eax, edi
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], 0x5d5b19
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3e8
call fcn.0049f440
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], str._lx___PAGE_EXECUTE_WRITECOPY_n
cmp eax, 0x80
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3e9
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], 0x5d6083
cmp eax, 0x1000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3ea
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], str._lx___SEC_IMAGE_n
cmp eax, 0x1000000
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jb 0x4aef58
mov eax, 0x3ed
call fcn.0049f440
mov eax, dword [0x57f2d0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x414]
mov dword [esp + 4], eax
mov eax, dword [0x57f2d4]
add eax, edi
add eax, dword [0x57f2cc]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.wrong_section_data_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
cmp dword [ebp - 0x3dc], eax
jae 0x4b01b8
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov edx, dword [ebp - 0x204]
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [0x57f2cc]
add eax, edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x3fd
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.VirtualAlloc_should_fail_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3fe
call fcn.0049f440
mov edx, dword [esi + 0x34]
mov eax, 1
cmp edx, 5
je 0x4aeede
xor eax, eax
cmp edx, 0x1e7
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], 0x5d400c
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4adf9a
mov edx, dword [ebp - 0x470]
xor eax, eax
mov edi, dword [edx + eax*4 + 0x5d6d98]
mov ebx, dword [esi + 0x34]
add eax, 1
cmp edi, ebx
je 0x4aef1e
cmp eax, 3
jbe 0x4aef08
mov eax, 0x462
call fcn.0049f440
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.unexpected_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, ebx
sete al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4ae666
mov eax, 0x3ef
call fcn.0049f440
mov eax, dword [0x57f2d0]
mov dword [esp + 4], str.section_data
mov dword [esp + 8], eax
mov eax, dword [0x57f2d4]
add eax, edi
jmp 0x4aee29
mov eax, 0x3e2
call fcn.0049f440
mov edx, dword [0x57f2cc]
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], 0x5d5acc
add edx, edi
mov dword [esp + 8], eax
cmp edx, eax
mov dword [esp + 0xc], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3e3
call fcn.0049f440
mov edx, dword [0x79ea48]
mov eax, dword [0x57f2c8]
add eax, edx
neg edx
sub eax, 1
and eax, edx
mov edx, dword [ebp - 0x20c]
mov dword [esp + 4], 0x5d606b
mov dword [esp + 0xc], eax
cmp eax, edx
mov dword [esp + 8], edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x3e5
call fcn.0049f440
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], 0x5d6096
cmp eax, 2
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4aed19
mov eax, 0x44f
call fcn.0049f440
lea eax, [ebp - 0x31c]
mov dword [esp + 4], 0x5d3769
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4af070
sub edx, 1
mov dword [eax + 0xbec], edx
xor eax, eax
mov ecx, 0x3c
lea edi, [ebp - 0x40c]
mov ebx, 4
rep stosd dword es:[edi], eax
mov eax, dword [0x79ea48]
mov ecx, 0x10b
mov edi, 4
mov word [ebp - 0x3fc], cx
mov esi, 1
lea ecx, [ebp - 0x31c]
lea edx, [eax + 0x160]
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3c4], edx
mov edx, str.section_data
mov dword [0x57f2d4], eax
mov dword [0x57f2cc], eax
mov dword [0x57f2c8], eax
lea eax, [ebp - 0x414]
mov word [ebp - 0x3d4], bx
mov word [ebp - 0x3cc], di
mov dword [ebp - 0x414], 0x4550
mov dword [ebp - 0x410], 0x1014c
mov dword [ebp - 0x400], 0x200200e0
mov byte [ebp - 0x3fa], 1
mov dword [ebp - 0x3e8], 0x10
mov dword [ebp - 0x3e0], 0x10000000
mov word [ebp - 0x3d0], si
mov dword [ebp - 0x3b4], 0x100000
mov dword [ebp - 0x3b0], 0x1000
mov dword [ebp - 0x3ac], 0x100000
mov dword [ebp - 0x3a8], 0x1000
mov dword [ebp - 0x3a0], 0x10
mov dword [ebp - 0x3b8], 0x1000003
mov dword [ebp - 0x3c0], 0x160
mov dword [0x57f2d0], 0x10
call fcn.004a1c30
lea eax, [ebp - 0x218]
mov dword [esp], 0x104
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
mov ebx, dword [sym.imp.kernel32.dll_GetTempFileNameW]
sub esp, 8
mov dword [esp + 0xc], 0x79e540
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5d6d60
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x218]
sub esp, 0x10
mov dword [esp + 0xc], 0x79e320
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5d6d60
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 0x10
mov dword [esp], 0x79e540
mov dword [ebp - 0x460], edi
call edi
sub esp, 4
call fcn.0057d110
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x228
mov dword [esp + 4], 0
mov dword [esp], 0x79e540
call ebx
sub esp, 8
mov dword [esp + 4], str.failed_to_create_dir_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], 0x79e320
call edi
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x22a
mov dword [esp + 4], 0
mov dword [esp], 0x79e320
call ebx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], str.failed_to_create_dir_n
call fcn.0049fda0
xor eax, eax
nop
movzx edx, word [eax + 0x79e540]
add eax, 2
mov word [eax + 0x79e0fe], dx
test dx, dx
jne 0x4af280
cmp word [0x79e100], 0
mov edx, 0x79e100
je 0x4af2b1
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af2a8
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x5d6d5c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af2b8
cmp word [0x79e100], 0
mov edx, 0x79e100
je 0x4af2e9
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af2e0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x79e320]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af2f0
cmp word [0x79e100], 0
mov edx, 0x79e100
je 0x4af321
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af318
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x5d6d5c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af328
cmp word [0x79e100], 0
je 0x4b0849
mov eax, 0x79e100
nop
add eax, 2
cmp word [eax], 0
jne 0x4af350
sub eax, 0x79e100
mov edx, 0x104
sar eax, 1
sub edx, eax
mov eax, 0x79e100
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4af370
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x5d6d50
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edx, 0x79e540
sub esp, 0xc
cmp word [0x79e540], 0
je 0x4af3a9
add edx, 2
cmp word [edx], 0
jne 0x4af3a0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x5d6d4c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af3b0
cmp word [0x79e540], 0
mov edx, 0x79e540
je 0x4af3e1
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af3d8
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.wldrtest.dll]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af3e8
cmp word [0x79e320], 0
mov edx, 0x79e320
je 0x4af419
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af410
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + 0x5d6d4c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af420
cmp word [0x79e320], 0
mov edx, 0x79e320
je 0x4af451
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4af448
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [eax + str.wldrtest.dll]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4af458
lea eax, [ebp - 0x218]
mov dword [esp + 0x14], 0x104
mov esi, 0xc000007b
xor ebx, ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x31c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x218]
sub esp, 0x18
mov dword [esp + 4], 0x79e320
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_MoveFileW]
mov ecx, 0x47e
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov dword [ebp - 0x3ec], 0x1234
sub esp, 8
call fcn.004aacc0
mov edi, eax
mov eax, 0x47f
call fcn.0049f440
mov eax, esi
cmp word [ebp - 0x410], 0xaa64
mov dword [esp + 8], edi
cmovne eax, ebx
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
cmp eax, edi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x40
mov ecx, 0x483
mov edx, str.section_data
mov word [ebp - 0x3b6], ax
lea eax, [ebp - 0x414]
call fcn.004aacc0
mov edi, eax
mov eax, 0x484
call fcn.0049f440
mov eax, esi
cmp word [ebp - 0x410], 0xaa64
mov dword [esp + 8], edi
cmovne eax, ebx
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
cmp eax, edi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x488
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov dword [ebp - 0x3f8], 0x1000
call fcn.004aacc0
mov edi, eax
mov eax, 0x489
call fcn.0049f440
cmp word [ebp - 0x410], 0xaa64
mov dword [esp + 8], edi
cmove ebx, esi
xor eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
cmp ebx, edi
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x140
mov ecx, 0x490
mov edx, str.section_data
mov word [ebp - 0x3b6], ax
xor eax, eax
mov word [0x79e760], ax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x3f8], 0
call fcn.004aacc0
mov ebx, eax
mov eax, 0x491
call fcn.0049f440
xor eax, eax
cmp ebx, 0xc000012f
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov edx, 0x5a4d
mov ecx, 0x495
lea eax, [ebp - 0x414]
mov word [0x79e760], dx
mov edx, str.section_data
mov dword [ebp - 0x414], 0x454e
call fcn.004aacc0
mov ebx, eax
mov eax, 0x496
call fcn.0049f440
xor eax, eax
cmp ebx, 0xc000011b
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
xor ebx, ebx
mov dword [esp], eax
call fcn.0049fda0
lea esi, [esi]
mov ecx, 0x49a
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov byte [ebp - 0x3de], bl
call fcn.004aacc0
mov esi, eax
cmp ebx, 2
je 0x4b0178
cmp ebx, 5
je 0x4b0130
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x4a4
xor eax, eax
cmp esi, 0xc000011b
sete al
mov dword [esp + 8], ebx
add ebx, 1
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.NtCreateSection__u_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
cmp ebx, 0x10
jne 0x4af680
mov ecx, 0x4ab
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov byte [ebp - 0x3de], 0
mov dword [0x79e79c], 0x98760000
mov edi, 0xffff8664
call fcn.004aacc0
mov esi, eax
mov eax, 0x4ac
call fcn.0049f440
xor eax, eax
cmp esi, 0xc0000130
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4b0
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov dword [0x79e79c], 0x40
mov dword [ebp - 0x414], 0xdeadbeef
call fcn.004aacc0
mov esi, eax
mov eax, 0x4b1
call fcn.0049f440
xor eax, eax
cmp esi, 0xc0000130
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xffffdead
mov ecx, 0x4b5
mov edx, str.section_data
mov word [ebp - 0x3fc], ax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x414], 0x4550
call fcn.004aacc0
mov esi, eax
mov eax, 0x4b6
call fcn.0049f440
xor eax, eax
cmp esi, 0xc000007b
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov edx, 0x10b
mov ecx, 0xffffdead
lea eax, [ebp - 0x414]
mov word [ebp - 0x3fc], dx
mov edx, str.section_data
mov word [ebp - 0x410], cx
mov ecx, 0x4ba
call fcn.004aacc0
mov esi, eax
mov eax, 0x4bb
call fcn.0049f440
xor eax, eax
cmp esi, 0xc000007b
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
xor esi, esi
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4be
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov word [ebp - 0x410], si
call fcn.004aacc0
mov esi, eax
mov eax, 0x4bf
call fcn.0049f440
xor eax, eax
cmp esi, 0xc000007b
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4c2
mov edx, str.section_data
lea eax, [ebp - 0x414]
mov word [ebp - 0x410], di
call fcn.004aacc0
mov esi, eax
mov eax, 0x4c3
call fcn.0049f440
xor eax, eax
cmp esi, 0xc000007b
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
xor esi, esi
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x14c
lea edx, [ebp - 0x454]
mov ecx, ebx
mov word [ebp - 0x410], ax
mov eax, dword [0x79ea48]
mov edi, edx
lea edx, [ebp - 0x45c]
mov dword [ebp - 0x3a0], 0x10
mov dword [ebp - 0x32c], eax
mov eax, esi
rep stosd dword es:[edi], eax
mov ecx, 0x4d1
lea eax, [ebp - 0x414]
mov dword [ebp - 0x328], 0x48
mov dword [0x57f2d0], 0x48
mov dword [ebp - 0x45c], 0x48
mov dword [ebp - 0x458], 0x40002
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x448], 0xbeef
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4d2
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 5
mov ecx, 0x4d5
lea edx, [ebp - 0x45c]
mov word [ebp - 0x456], ax
lea eax, [ebp - 0x414]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4d6
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4da
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x458], 3
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4db
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4de
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x44c], 3
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4df
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4e2
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x44c], 0x20001
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4e3
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4e6
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x44c], 0
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4e7
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x4eb
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x328], 1
call fcn.004aacc0
mov ebx, eax
mov eax, 0x4ec
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
cmp word [ebp - 0x3fc], 0x10b
je 0x4b0210
lea edx, [ebp - 0x210]
mov eax, esi
mov ecx, 0x3c
mov ebx, 0x10b
mov edi, edx
mov esi, 4
mov edx, str.section_data
mov dword [0x57f2e4], 0x60000020
rep stosd dword es:[edi], eax
mov eax, 4
mov edi, 1
mov word [ebp - 0x200], bx
mov word [ebp - 0x1d0], ax
mov eax, 3
mov ecx, 0x57c
mov word [ebp - 0x1bc], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x4550
mov dword [ebp - 0x214], 0x1014c
mov dword [ebp - 0x204], 0x200200e0
mov byte [ebp - 0x1fe], 1
mov dword [ebp - 0x1fc], 0x1000
mov dword [ebp - 0x1f0], 0x1000
mov dword [ebp - 0x1e4], 0x10000000
mov dword [ebp - 0x1e0], 0x1000
mov dword [ebp - 0x1dc], 0x1000
mov word [ebp - 0x1d8], si
mov word [ebp - 0x1d4], di
mov dword [ebp - 0x1c4], 0x160
mov dword [ebp - 0x1c8], 0x1160
mov dword [ebp - 0x1b8], 0x321000
mov dword [ebp - 0x1b4], 0x123000
call fcn.004aacc0
mov ebx, eax
mov eax, 0x57d
call fcn.0049f440
xor eax, eax
cmp ebx, 0xc000007b
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x14c
mov ecx, 0x588
mov edx, str.section_data
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x589
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x58e
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0x1000
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x58f
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x594
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x60000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x595
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x40
mov ecx, 0x59b
mov dword [ebp - 0x1fc], 0x1000
mov word [ebp - 0x1ba], ax
mov edx, str.section_data
lea eax, [ebp - 0x218]
mov dword [ebp - 0x1f0], 0
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x59c
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5a1
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5a2
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
mov ecx, 0x5aa
mov dword [ebp - 0x1a4], 0x10
mov dword [ebp - 0x12c], 0x48
lea edx, [ebp - 0x45c]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x458], 0x40002
mov dword [ebp - 0x44c], 1
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5ab
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5ae
mov dword [ebp - 0x1fc], 0x1000
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5af
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, 5
mov ecx, 0x5b2
lea edx, [ebp - 0x45c]
mov word [ebp - 0x456], ax
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5b3
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5b6
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 3
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5b7
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5ba
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 0x20001
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5bb
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5be
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 0
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5bf
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x5c3
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x328], 1
call fcn.004aacc0
mov ebx, eax
mov eax, 0x5c4
call fcn.0049f440
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
mov dword [0x57f2e4], 0x40000040
mov dword [esp], 0x79e540
mov eax, dword [ebp - 0x460]
call eax
sub esp, 4
cmp word [0x79e540], 0
je 0x4b0858
mov eax, 0x79e540
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4b0070
sub eax, 0x79e542
cmp word [eax + 0x79e540], 0x5c
lea edx, [eax + 0x79e540]
je 0x4b0099
nop
sub edx, 2
cmp word [edx], 0x5c
jne 0x4b0090
xor ecx, ecx
mov ebx, dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov word [edx], cx
mov dword [esp], 0x79e540
call ebx
sub esp, 4
mov dword [esp], 0x79e320
mov eax, dword [ebp - 0x460]
call eax
sub esp, 4
cmp word [0x79e320], 0
je 0x4b0862
mov eax, 0x79e320
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4b00d8
sub eax, 0x79e322
cmp word [eax + 0x79e320], 0x5c
lea edx, [eax + 0x79e320]
je 0x4b0109
lea esi, [esi]
lea esi, [esi]
sub edx, 2
cmp word [edx], 0x5c
jne 0x4b0100
xor eax, eax
mov word [edx], ax
mov dword [esp], 0x79e320
call ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x4a1
xor eax, eax
cmp esi, 0xc0000130
sete al
mov dword [esp + 0xc], esi
mov dword [esp + 8], 5
mov dword [esp + 4], str.NtCreateSection__u_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
add ebx, 1
jmp 0x4af680
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x49e
xor eax, eax
cmp esi, 0xc0000131
sete al
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], str.NtCreateSection__u_error__08lx_n
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4b0169
mov esi, dword [0x57f2cc]
add esi, dword [0x57f2d4]
add esi, dword [0x57f2d0]
add esi, edi
lea ebx, [esi + eax - 1]
neg eax
and ebx, eax
mov eax, 0x3f8
call fcn.0049f440
sub ebx, esi
mov dword [esp + 4], 0x5d7340
mov dword [esp + 8], ebx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_memcmp]
mov dword [esp + 4], str.alignment_should_not_be_cleared_n
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
jmp 0x4aee5a
mov eax, esi
lea edi, [ebp - 0x218]
mov ecx, 0x42
mov edx, 0x20b
rep stosd dword es:[edi], eax
mov ebx, 1
mov ecx, 4
mov esi, 4
mov edi, 3
mov word [ebp - 0x200], dx
lea eax, [ebp - 0x218]
mov edx, str.section_data
mov word [ebp - 0x1d8], cx
mov ecx, 0x509
mov word [ebp - 0x1d4], bx
mov dword [ebp - 0x218], 0x4550
mov dword [ebp - 0x214], 0x1014c
mov dword [ebp - 0x204], 0x200200f0
mov byte [ebp - 0x1fe], 1
mov dword [ebp - 0x1fc], 0x1000
mov dword [ebp - 0x1f0], 0x1000
mov dword [ebp - 0x1e8], 0x10000000
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x1e0], 0x1000
mov dword [ebp - 0x1dc], 0x1000
mov word [ebp - 0x1d0], si
mov dword [ebp - 0x1c4], 0x170
mov dword [ebp - 0x1c8], 0x1170
mov word [ebp - 0x1bc], di
mov dword [ebp - 0x1b8], 0x321000
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0x123000
mov dword [ebp - 0x1ac], 0
mov dword [0x57f2e4], 0x60000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x50a
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0x2df
sub eax, 0x3fffff85
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xffffaa64
mov ecx, 0x512
mov edx, str.section_data
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x513
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0x2df
sub eax, 0x3fffff85
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0xffff8664
mov ecx, 0x517
mov edx, str.section_data
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x518
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x51e
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0x1000
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x51f
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x525
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x60000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x526
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 0x40
mov ecx, 0x52d
mov dword [ebp - 0x1fc], 0x1000
mov word [ebp - 0x1ba], ax
mov edx, str.section_data
lea eax, [ebp - 0x218]
mov dword [ebp - 0x1f0], 0
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x52e
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x534
mov edx, str.section_data
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f0], 0
lea eax, [ebp - 0x218]
mov dword [0x57f2e4], 0x40000020
call fcn.004aacc0
mov ebx, eax
mov eax, 0x535
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [0x79ea48]
lea edx, [ebp - 0x45c]
mov dword [ebp - 0x194], 0x10
mov dword [ebp - 0x11c], 0x48
mov ecx, 0x53e
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x458], 0x40002
mov dword [ebp - 0x44c], 1
call fcn.004aacc0
mov ebx, eax
mov eax, 0x53f
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x45c]
mov ecx, 0x543
mov dword [ebp - 0x1fc], 0x1000
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x544
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 5
lea edx, [ebp - 0x45c]
mov ecx, 0x548
mov word [ebp - 0x456], ax
lea eax, [ebp - 0x218]
call fcn.004aacc0
mov ebx, eax
mov eax, 0x549
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x45c]
mov ecx, 0x54d
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 3
call fcn.004aacc0
mov ebx, eax
mov eax, 0x54e
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x45c]
mov ecx, 0x552
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 0x20001
call fcn.004aacc0
mov ebx, eax
mov eax, 0x553
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea edx, [ebp - 0x45c]
mov ecx, 0x557
lea eax, [ebp - 0x218]
mov dword [ebp - 0x44c], 0
call fcn.004aacc0
mov ebx, eax
mov eax, 0x558
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, 0x55d
lea edx, [ebp - 0x45c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x328], 1
call fcn.004aacc0
mov ebx, eax
mov eax, 0x55e
call fcn.0049f440
cmp dword [0x79ea44], 1
mov dword [esp + 8], ebx
sbb eax, eax
mov dword [esp + 4], str.NtCreateSection_error__08lx_n
and eax, 0xc000035a
cmp eax, ebx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
jmp 0x4b003b
mov edx, 0x104
mov eax, 0x79e100
jmp 0x4af379
mov eax, 0xfffffffe
jmp 0x4b007e
mov eax, 0xfffffffe
jmp 0x4b00e6