Function at 0x446ed0
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x128
jmp 0x446ede
cmp dword [0x4765f0], 0
sete al
test al, 1
jne 0x446ef1
jmp 0x447968
mov cx, word [0x4755d0]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
and ax, 0x170b
xor ax, 0xffff
xor cx, 0xffff
or cx, 0x170b
and ax, cx
xor ax, 0xffff
mov word [0x475610], ax
mov ax, word [0x4755d2]
mov cx, ax
and cx, cx
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
and dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
or dx, 0x945d
and ax, 0x945d
xor ax, 0xffff
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
and cx, 0xffff
xor cx, 0xffff
xor cx, 0xffff
or cx, 0
and ax, ax
xor ax, 0xffff
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
or ax, 0
or cx, ax
mov word [0x475612], cx
mov ax, word [0x4755d4]
xor ax, 0x3777
mov word [0x475614], ax
mov ax, word [0x4755d6]
xor ax, 0x5357
mov word [0x475616], ax
mov ax, word [0x4755d8]
xor ax, 0x933a
mov word [0x475618], ax
mov ax, word [0x4755da]
mov cx, ax
and cx, 0xf6df
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
or dx, 0x920
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0xf6df
sub ax, cx
mov word [0x47561a], ax
mov ax, word [0x4755dc]
mov cx, ax
xor cx, 0x52fd
xor cx, 0xffff
and cx, 0x52fd
shl cx, 1
sub cx, 0x52fd
sub ax, cx
mov word [0x47561c], ax
mov ax, word [0x4755de]
xor ax, 0xffe4
mov word [0x47561e], ax
mov ax, word [0x4755e0]
mov dx, ax
and dx, dx
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
and dx, cx
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
or cx, 0
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
and cx, 0xeffb
xor ax, 0xffff
xor ax, 0xffff
or ax, 0xeffb
xor ax, 0xffff
and ax, 0xffff
or cx, ax
mov ax, cx
xor ax, 0xffff
xor cx, 0xffff
and ax, cx
or ax, 0
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
mov word [0x475620], ax
mov ax, word [0x4755e2]
xor ax, 0x6eb0
mov word [0x475622], ax
mov ax, word [0x4755e4]
mov cx, ax
xor cx, 0xffff
and cx, 0x6987
and ax, 0x9678
or cx, ax
xor cx, 0xbeb3
mov word [0x475624], cx
mov ax, word [0x4755e6]
mov cx, ax
or cx, cx
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
or dx, 0
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
mov cx, dx
xor cx, 0xffff
and cx, 0x9d26
and dx, 0x62d9
or cx, dx
xor cx, 0x62d9
and cx, 0xc2cd
mov dx, ax
and dx, 0xc2cd
xor ax, 0xc2cd
or dx, ax
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
mov word [str.69F_], cx
mov ax, word [0x4755e8]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x4284
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x4284
xor edx, edx
sub dx, cx
add ax, dx
mov word [0x475628], ax
mov ax, word [0x4755ea]
xor ax, 0x3d00
mov word [0x47562a], ax
mov cx, word [0x4755ec]
mov ax, cx
xor ax, 0xffff
mov dx, ax
xor dx, 0x3cb0
xor dx, 0xffff
or ax, 0x3cb0
and ax, dx
and cx, 0xc34f
mov dx, ax
and dx, cx
xor ax, cx
or dx, ax
mov word [0x47562c], dx
mov ax, word [0x4755ee]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x62ef
xor ax, 0xffff
or ax, ax
xor ax, 0xffff
xor ax, 0xffff
and ax, 0x9d10
xor cx, 0xffff
xor ax, 0xffff
and ax, 0xffff
or ax, 0
and cx, ax
mov word [0x47562e], cx
mov ax, word [0x4755f0]
xor ax, 0x50c2
mov word [0x475630], ax
mov ax, word [0x4755f2]
xor ax, 0x3c10
mov word [0x475632], ax
mov ax, word [0x4755f4]
mov cx, ax
xor cx, 0xffff
and cx, 0x732e
mov dx, ax
and dx, 0x8cd1
or cx, dx
xor cx, 0xe46a
xor cx, 0xffff
and cx, 0x9744
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0x9744
sub ax, cx
mov word [0x475634], ax
mov ax, word [0x4755f6]
mov cx, ax
and cx, 0x306f
shl cx, 1
add ax, 0x306f
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x475636], ax
mov ax, word [0x4755f8]
xor ax, 0xca9d
mov word [0x475638], ax
mov ax, word [0x4755fa]
mov cx, ax
and cx, 0xf909
shl cx, 1
add ax, 0xf909
sub ax, cx
mov word [0x47563a], ax
mov ax, word [0x4755fc]
mov cx, ax
xor cx, 0x70d7
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
mov dx, cx
xor dx, 0x70d7
xor dx, 0xffff
or cx, 0x70d7
and cx, dx
shl cx, 1
add cx, 0x8cd6
sub cx, 0x70d7
sub cx, 0x8cd6
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x47563c], ax
mov cx, word [0x4755fe]
mov ax, cx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
mov dx, cx
xor dx, 0xffff
and dx, 0xcf8b
mov si, cx
and si, 0x3074
or dx, si
xor dx, 0x3074
or ax, dx
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
or ax, 0xea82
xor cx, 0xffff
mov dx, cx
and dx, 0x157d
xor cx, 0x157d
or dx, cx
mov cx, ax
add cx, 1
xor ax, 0xffff
or ax, dx
add ax, cx
mov cx, ax
xor cx, 0xffff
and cx, 0xa9e8
and ax, 0x5617
or cx, ax
xor cx, 0x5617
mov word [0x47563e], cx
mov ax, word [0x475600]
mov cx, ax
and cx, 0xa3e7
shl cx, 1
add ax, 0xa3e7
add ax, 0xcdeb
sub ax, cx
sub ax, 0xcdeb
mov word [0x475640], ax
mov ax, word [0x475602]
xor ax, 0xc835
mov word [0x475642], ax
mov ax, word [0x475604]
mov cx, ax
xor cx, 0xffff
or cx, 0x1825
add cx, 0xe7db
and ax, 0x1825
or cx, ax
xor cx, 0xdb51
mov word [0x475644], cx
mov cx, word [0x475606]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
xor ax, 0xffff
or ax, 0xe1fd
xor cx, 0xffff
or cx, 0x1e02
and ax, cx
xor ax, 0xffff
mov word [0x475646], ax
mov ax, word [0x475608]
xor ax, 0xc987
mov word [0x475648], ax
mov cx, word [0x4755b0]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
xor ax, 0xffff
or ax, 0xd332
and cx, 0xd332
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [str.b_tq], ax
mov ax, word [0x4755b2]
xor ax, 0xf96a
mov word [0x4755bc], ax
mov ax, word [0x4755b4]
mov cx, ax
xor cx, 0xffff
and cx, 0xf083
and ax, 0xf7c
or cx, ax
mov word [0x4755be], cx
mov ax, word [0x4755b6]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, cx
and dx, ax
mov cx, dx
xor cx, 0xffff
and cx, 0x4e24
and dx, 0xb1db
or cx, dx
xor cx, 0xb1db
and cx, 0x4b97
xor cx, 0xffff
or ax, ax
xor ax, 0xffff
or ax, 0x4b97
xor ax, 0xffff
xor ax, 0xffff
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
mov di, ax
xor di, 0xffff
mov si, dx
and si, 0x1684
and cx, 0xe97b
mov bx, di
and bx, 0x1684
and ax, 0xe97b
or si, cx
or bx, ax
xor si, bx
or dx, di
xor dx, 0xffff
and dx, 0xffff
or si, dx
mov word [0x4755c0], si
mov ax, word [0x4755b8]
mov cx, ax
xor cx, 0xf8f9
xor cx, 0xffff
or cx, cx
xor cx, 0xffff
or cx, 0x706
xor cx, 0xffff
shl cx, 1
mov dx, cx
xor dx, 0xffff
and dx, 0xf8f9
and cx, 0x706
sub cx, dx
sub ax, cx
mov word [0x4755c2], ax
mov cx, word [0x475580]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
or ax, 0x58fe
xor ax, 0xffff
xor cx, 0xffff
and cx, 0x58fe
or ax, cx
xor ax, 0xffff
mov word [0x47558e], ax
mov ax, word [0x475582]
mov cx, ax
xor cx, 0xffff
and cx, 0xb711
and ax, 0x48ee
or cx, ax
mov word [0x475590], cx
mov ax, word [0x475584]
mov cx, ax
xor cx, 0xffff
and cx, 0x9ec0
and ax, 0x613f
or cx, ax
mov word [0x475592], cx
mov ax, word [0x475586]
xor ax, 0xdf6a
mov word [0x475594], ax
mov ax, word [0x475588]
xor ax, 0xba21
mov word [0x475596], ax
mov ax, word [0x47558a]
mov cx, ax
xor cx, 0xffff
and cx, 0xc1ea
and ax, 0x3e15
or cx, ax
mov word [0x475598], cx
mov ax, word [0x47558c]
mov cx, ax
xor cx, 0xffff
and cx, 0x5ec9
and ax, 0xa136
or cx, ax
xor cx, 0x4f5c
mov word [0x47559a], cx
mov ax, word [0x47559c]
mov dx, ax
or dx, dx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
or dx, 0
xor dx, 0xffff
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x878f
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, 0x7870
add ax, dx
or cx, ax
mov word [0x4755a6], cx
mov ax, word [0x47559e]
xor ax, 0x7cb2
mov word [0x4755a8], ax
mov cx, word [0x4755a0]
mov ax, cx
xor ax, 0xffff
mov dx, ax
xor dx, 0x983
xor dx, 0xffff
or ax, 0x983
and ax, dx
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
or dx, 0x983
xor dx, 0xffff
or ax, dx
mov cx, ax
xor cx, 0xa61a
xor cx, 0xffff
and cx, 0xa61a
shl cx, 1
sub cx, 0xa61a
sub ax, cx
mov word [0x4755aa], ax
mov ax, word [0x4755a2]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
or cx, 0x343f
and ax, 0x343f
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x4755ac], cx
mov ax, word [0x4755a4]
xor ax, 0xcfc9
mov word [0x4755ae], ax
mov ax, word [0x47564a]
mov cx, ax
xor cx, 0x6bca
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
or cx, 0
xor cx, 0xffff
and cx, 0x6bca
shl cx, 1
add cx, 0xffbe
sub cx, 0x6bca
sub cx, 0xffbe
sub ax, cx
mov word [0x475654], ax
mov ax, word [0x47564c]
mov cx, ax
or cx, cx
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
or cx, 0x9344
add cx, 0x6cbc
xor ax, 0xffff
or ax, 0x6cbb
xor ax, 0xffff
and ax, 0xffff
or cx, ax
mov word [0x475656], cx
mov ax, word [0x47564e]
mov cx, ax
and cx, cx
xor cx, 0xffff
and cx, 0x3352
xor cx, 0xffff
and ax, 0xccad
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x475658], cx
mov ax, word [0x475650]
mov cx, ax
xor cx, 0xddac
xor cx, 0xffff
and cx, 0xddac
shl cx, 1
sub cx, 0xddac
sub ax, cx
mov word [0x47565a], ax
mov ax, word [str._no_t8]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
or cx, 0x90f5
and ax, 0x90f5
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x47565c], cx
mov dword [0x4765f0], 1
push eax
mov esi, esp
push eax
mov edi, esp
push eax
mov dword [ebp - 0xd4], esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0xd8], esp
push eax
mov dword [ebp - 0x90], esp
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x88], esp
push eax
mov dword [ebp - 0xd0], esp
push eax
mov dword [ebp - 0xcc], esp
push eax
mov dword [ebp - 0xc8], esp
push eax
mov dword [ebp - 0xc4], esp
push eax
mov dword [ebp - 0xc0], esp
push eax
mov dword [ebp - 0x84], esp
push eax
mov dword [ebp - 0x50], esp
sub esp, 8
mov dword [ebp - 0x80], esp
push eax
mov dword [ebp - 0x7c], esp
push eax
mov dword [ebp - 0xbc], esp
push eax
mov dword [ebp - 0xb8], esp
push eax
mov dword [ebp - 0xb4], esp
push eax
mov dword [ebp - 0x120], esp
push eax
mov dword [ebp - 0x78], esp
push eax
mov dword [ebp - 0xb0], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x74], esp
push eax
mov dword [ebp - 0x44], esp
sub esp, 8
mov dword [ebp - 0x11c], esp
push eax
mov dword [ebp - 0x70], esp
push eax
mov dword [ebp - 0xac], esp
push eax
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x6c], esp
push eax
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x38], esp
sub esp, 8
mov dword [ebp - 0x118], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x80
mov dword [ebp - 0x64], esp
sub esp, 0x400
mov dword [ebp - 0x14], esp
sub esp, 0x10
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0x110], esp
push eax
mov dword [ebp - 0x5c], esp
sub esp, 0xc
mov dword [ebp - 0x10c], esp
sub esp, 0x400
mov dword [ebp - 0x108], esp
sub esp, 0x44
mov dword [ebp - 0x104], esp
sub esp, 0x10
mov dword [ebp - 0x100], esp
sub esp, 0xc
mov dword [ebp - 0xfc], esp
sub esp, 0x400
mov dword [ebp - 0xf4], esp
sub esp, 0xc
mov dword [ebp - 0xf0], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xec], esp
sub esp, 0x3c
mov dword [ebp - 0xe8], esp
sub esp, 0x400
mov dword [ebp - 0xa8], esp
sub esp, 0x44
mov dword [ebp - 0xa4], esp
sub esp, 0x10
mov dword [ebp - 0xe4], esp
sub esp, 8
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0xf8], esp
push eax
mov dword [ebp - 0x60], esp
call fcn.0044ca20
mov dword [edi], eax
mov eax, dword [edi]
mov edi, dword [ebp - 0xd4]
sub esp, 4
mov dword [esp], eax
call section..text
add esp, 4
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401530
add esp, 4
cmp eax, 4
je 0x447b64
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401650
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 1
mov ebx, esi
jmp 0x448f6f
mov dword [ebp - 0x94], esi
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401330
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebx]
lea ecx, [0x469752]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x447bcd
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401650
add esp, 4
mov ebx, dword [ebp - 0x94]
mov dword [ebx], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 1
jmp 0x448f6f
mov eax, dword [ebx]
lea ecx, [0x469754]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.004014f0
add esp, 0xc
cmp eax, 0
mov esi, dword [ebp - 0x1c]
jne 0x447c1e
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401650
add esp, 4
mov ebx, dword [ebp - 0x94]
mov dword [ebx], 0
mov dword [esi], 1
jmp 0x448f6f
mov eax, dword [ebx]
lea ecx, [0x469756]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401370
add esp, 8
mov ecx, dword [ebp - 0xd8]
mov dword [ecx], eax
mov eax, dword [ebx]
lea ecx, [0x469754]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401370
add esp, 8
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
jmp 0x447c6d
mov eax, dword [ebp - 0x54]
mov edi, dword [eax]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004015b0
add esp, 4
cmp edi, eax
setb al
test al, 1
mov edi, dword [ebp - 0x1c]
jne 0x447ca1
jmp 0x447c96
mov dword [edi], 2
jmp 0x448e32
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004015d0
add esp, 8
mov esi, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [0x469759]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x447cf7
mov dword [edi], 4
jmp 0x448e13
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469759
call fcn.004012e0
add esp, 8
fnstcw word [ebp - 0x2e]
movzx eax, word [ebp - 0x2e]
or eax, 0xc00
mov word [ebp - 0x9e], ax
fldcw word [ebp - 0x9e]
fistp dword [ebp - 0x134]
fldcw word [ebp - 0x2e]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
cmp dword [ecx], 0
jne 0x4482a7
jmp 0x447d47
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46975b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447d7b
jmp 0x447e39
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46975d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.004014f0
add esp, 0xc
cmp eax, 0
je 0x447e39
jmp 0x447dab
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447ddc
jmp 0x447e39
jmp 0x447dde
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x469761]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447e0f
jmp 0x447e39
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x447e44
mov dword [edi], 4
jmp 0x448e13
mov edi, dword [ebp - 0x10]
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975b
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975d
call fcn.00401370
add esp, 8
mov ecx, dword [ebp - 0x88]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975f
call fcn.00401290
add esp, 8
mov esi, dword [ebp - 0xd0]
mov dword [esi], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469761
call fcn.004012e0
add esp, 8
fnstcw word [ebp - 0x2c]
movzx eax, word [ebp - 0x2c]
or eax, 0xc00
mov word [ebp - 0x9c], ax
fldcw word [ebp - 0x9c]
fistp dword [ebp - 0x124]
fldcw word [ebp - 0x2c]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469763
call fcn.004012e0
add esp, 8
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
or eax, 0xc00
mov word [ebp - 0x9a], ax
fldcw word [ebp - 0x9a]
fistp dword [ebp - 0x128]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0xc4]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4905d07b
mov ecx, eax
and ecx, 0xb6fa2f84
or edx, ecx
xor edx, 0xb6fa2f84
and edx, 2
mov ecx, eax
xor ecx, 2
and ecx, eax
imul ecx, edx
mov edx, eax
xor edx, 0xffffffff
or edx, 0xfffffffd
xor edx, 0xffffffff
and edx, 0xffffffff
or eax, 2
imul eax, edx
add eax, ecx
sub eax, 0xfffffffe
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov edi, dword [ebp - 0x84]
mov dword [edi], eax
mov ecx, dword [esi]
shl ecx, 1
mov eax, ecx
xor eax, 0xffffffff
or eax, 0xfffffffd
xor eax, 0xffffffff
and eax, 0xffffffff
or ecx, 2
add eax, 0xcef211b2
add eax, ecx
sub eax, 0xcef211b2
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov esi, dword [ebp - 0xc4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov edi, dword [ebp - 0xc0]
mov eax, dword [edi]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x50]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
call fcn.004305d0
add esp, 8
mov esi, dword [ebp - 0x7c]
mov dword [esi], 0
jmp 0x44808a
jmp 0x44808c
mov edi, dword [esi]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004015b0
add esp, 4
cmp edi, eax
setb al
test al, 1
mov edi, dword [ebp - 0x1c]
jne 0x4480bd
jmp 0x4480b2
mov dword [edi], 5
jmp 0x448268
mov esi, dword [ebp - 0x7c]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401550
add esp, 8
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00401530
add esp, 4
cmp eax, 2
jne 0x448246
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004012b0
add esp, 4
mov ecx, dword [ebp - 0xb8]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
mov edi, dword [ecx]
mov edx, edi
and edx, 0xfffffffd
mov eax, edi
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov dword [ebp - 0xe0], eax
mov eax, edi
xor eax, 2
xor eax, 0xffffffff
mov edx, edi
or edx, 2
and edx, eax
mov ecx, edi
and ecx, 0xfffffffd
mov eax, edi
xor eax, 2
add edi, eax
sub edi, ecx
mov ecx, edx
xor ecx, 0xffffffff
mov esi, edi
and esi, ecx
mov eax, edi
or eax, ecx
xor eax, 0xffffffff
imul eax, esi
mov ecx, edi
and ecx, edx
or edi, edx
imul edi, ecx
add edi, eax
xor eax, eax
sub eax, edi
xor ecx, ecx
sub ecx, dword [ebp - 0xe0]
add eax, ecx
xor ecx, ecx
sub ecx, eax
add ecx, 2
sub esp, 4
mov dword [esp], ecx
call fcn.004557d4
add esp, 4
mov edi, dword [ebp - 0x120]
mov dword [edi], eax
mov esi, dword [ebp - 0xb4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov esi, dword [edi]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], esi
mov esi, dword [ebp - 0x7c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0xdc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x80]
mov dword [esp + 0x14], eax
call fcn.0040b3b0
add esp, 0x18
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
jmp 0x448248
jmp 0x44824a
jmp 0x44824c
mov eax, dword [esi]
mov ecx, eax
and ecx, 1
or eax, 1
mov edx, ecx
and edx, eax
shl edx, 1
xor ecx, eax
add ecx, edx
mov dword [esi], ecx
jmp 0x44808a
sub esp, 4
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.004306a0
add esp, 4
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
jmp 0x448e0d
jmp 0x4482a9
mov eax, dword [ebp - 0x24]
cmp dword [eax], 1
sete al
test al, 1
jne 0x4482bb
jmp 0x4484c5
call fcn.004061e0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46975b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
je 0x448314
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x44831f
mov dword [edi], 4
jmp 0x448e13
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
lea ecx, [0x46975b]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
shl eax, 1
xor ecx, ecx
sub ecx, eax
add ecx, 0xfffffffe
xor eax, eax
sub eax, ecx
add eax, 0
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov esi, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
shl eax, 1
add eax, 0x10a57dea
sub eax, 0xfffffffe
sub eax, 0x10a57dea
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x44]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov esi, dword [ebp - 0x11c]
mov dword [esp + 4], esi
call fcn.004305d0
add esp, 8
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x74]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.00402c10
add esp, 0xc
mov dword [esp], esi
call fcn.004306a0
add esp, 4
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
jmp 0x448e0b
mov eax, dword [ebp - 0x24]
cmp dword [eax], 2
jne 0x4486d9
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
lea ecx, [0x46975b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
je 0x448522
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x44852d
mov dword [edi], 4
jmp 0x448e13
mov eax, dword [esi]
lea ecx, [0x46975b]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov esi, dword [ebp - 0x6c]
mov dword [esi], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
add eax, ecx
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [esi]
shl eax, 1
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, ecx
add eax, 2
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.004557d4
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x3c]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xac]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x38]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004557ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov esi, dword [ebp - 0x118]
mov dword [esp + 4], esi
call fcn.004305d0
add esp, 8
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.004494f0
add esp, 8
mov dword [esp], esi
call fcn.004306a0
add esp, 4
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
jmp 0x448e09
jmp 0x4486db
mov eax, dword [ebp - 0x24]
cmp dword [eax], 3
sete al
test al, 1
jne 0x4486ea
jmp 0x4486f3
jmp 0x4486ec
jmp 0x4486ee
jmp 0x448e03
mov eax, dword [ebp - 0x24]
cmp dword [eax], 4
jne 0x448dfd
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
lea ecx, [0x469766]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x469768]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x46976b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x469766]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.004014f0
add esp, 0xc
cmp eax, 0
je 0x4487fb
jmp 0x4487a0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x469768]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4487d1
jmp 0x4487fb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [0x46976b]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.004014f0
add esp, 0xc
cmp eax, 0
jne 0x448808
jmp 0x4487fd
mov dword [edi], 4
jmp 0x448df4
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469766
call fcn.00401290
add esp, 8
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469768
call fcn.004012e0
add esp, 8
fnstcw word [ebp - 0x28]
movzx eax, word [ebp - 0x28]
or eax, 0xc00
mov word [ebp - 0x98], ax
fldcw word [ebp - 0x98]
fistp dword [ebp - 0x12c]
fldcw word [ebp - 0x28]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976b
call fcn.004012e0
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x96], ax
fldcw word [ebp - 0x96]
fistp dword [ebp - 0x130]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.00450830
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.00450830
add esp, 0xc
mov ax, word [0x47559a]
mov ecx, dword [ebp - 0x114]
mov word [ecx + 0xc], ax
mov eax, dword [0x475596]
mov dword [ecx + 8], eax
mov eax, dword [0x475592]
mov dword [ecx + 4], eax
mov eax, dword [0x47558e]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.00448f80
sub esp, 4
mov dword [esp], eax
call fcn.00455aac
add esp, 4
call fcn.00455abe
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
and eax, 0xa
or edx, 0xa
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov esi, dword [ebp - 0x110]
mov dword [esi], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], 0
mov eax, dword [ecx]
cmp eax, dword [esi]
jl 0x44897b
mov dword [edi], 8
jmp 0x4489af
jmp 0x44897d
call fcn.00455abe
mov ecx, 0x18
cdq
idiv ecx
xor eax, eax
sub eax, edx
mov ecx, 0x61
sub ecx, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x64]
mov word [edx + eax*2], cx
jmp 0x4489a3
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx]
sub eax, 0xffffffff
mov dword [ecx], eax
jmp 0x44896d
lea eax, [0x46813a]
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00459215
mov dword [esp], esi
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
call fcn.00459215
add esp, 8
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x448b48
mov eax, dword [str.b_tq]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
mov eax, dword [0x4755be]
mov dword [ecx + 4], eax
mov ax, word [0x4755c2]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459215
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x448a78
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0x108]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450830
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004557ff
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042fcc0
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x448b37
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0x104]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450830
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0x100]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450830
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448b37
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jne 0x448b45
jmp 0x448b41
jmp 0x448b43
jmp 0x448b45
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [eax], 1
jne 0x448c38
mov eax, dword [0x475654]
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
mov eax, dword [0x475658]
mov dword [ecx + 4], eax
mov ax, word [0x47565c]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459215
add esp, 8
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jl 0x448bf8
jmp 0x448b92
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
setle al
test al, 1
jne 0x448ba1
jmp 0x448bf8
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xf4]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450830
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004557ff
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042fcc0
add esp, 8
jmp 0x448bfa
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
sete al
test al, 1
jne 0x448c09
jmp 0x448c18
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jne 0x448c22
jmp 0x448c22
jmp 0x448c24
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
sete al
test al, 1
jne 0x448c33
jmp 0x448c35
jmp 0x448c35
mov edi, dword [ebp - 0x1c]
jmp 0x448c3a
mov eax, dword [ebp - 0x20]
cmp dword [eax], 2
sete al
test al, 1
jne 0x448c4c
jmp 0x448ddb
mov eax, dword [0x4755a6]
mov ecx, dword [ebp - 0xf0]
mov dword [ecx], eax
mov eax, dword [0x4755aa]
mov dword [ecx + 4], eax
mov ax, word [0x4755ae]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459215
add esp, 8
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xec]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450830
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004557ff
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042fcc0
add esp, 8
lea eax, [0x475610]
sub esp, 0xc
mov esi, dword [ebp - 0xe8]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.0044fd30
sub esp, 4
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov dword [esp + 4], 0x200
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
call fcn.00448f90
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xa4]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450830
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xe4]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450830
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov eax, dword [ebp - 0xa8]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, dword [ebp - 0xa4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448ddd
mov eax, dword [ebp - 0x20]
cmp dword [eax], 3
sete al
test al, 1
jne 0x448dec
jmp 0x448dee
jmp 0x448dee
mov dword [edi], 0
mov eax, dword [edi]
cmp eax, 0
jne 0x448e13
jmp 0x448dfd
jmp 0x448dff
jmp 0x448e01
jmp 0x448e03
jmp 0x448e05
jmp 0x448e07
jmp 0x448e09
jmp 0x448e0b
jmp 0x448e0d
mov dword [edi], 0
mov eax, dword [edi]
test eax, eax
je 0x448e1d
jmp 0x448e1b
jmp 0x448e23
jmp 0x448e1f
jmp 0x448e21
jmp 0x448e23
mov ecx, dword [ebp - 0x54]
mov eax, dword [ecx]
sub eax, 0xffffffff
mov dword [ecx], eax
jmp 0x447c6b
call fcn.00446e60
sub esp, 8
mov dword [esp], 1
mov esi, dword [ebp - 0x58]
mov dword [esp + 4], esi
call fcn.004305d0
add esp, 4
mov dword [esp], esi
call fcn.0044b030
mov dword [esp], esi
call fcn.0044a840
add esp, 4
mov eax, dword [ebx]
lea ecx, [0x46976d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.004014f0
add esp, 0xc
cmp eax, 0
je 0x448ec9
mov eax, dword [ebx]
lea ecx, [0x46976d]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013c0
add esp, 8
mov ecx, dword [ebp - 0xf8]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x448eb8
jmp 0x448ec9
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.00449cf0
add esp, 4
jmp 0x448ecb
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.004306a0
add esp, 4
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebx]
lea ecx, [0x469770]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.004014f0
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x448f13
jmp 0x448f32
mov eax, dword [ebx]
lea ecx, [0x469770]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013c0
add esp, 8
mov ecx, dword [ebp - 0x60]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401650
add esp, 4
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
je 0x448f59
jmp 0x448f52
call fcn.00449f80
jmp 0x448f59
mov ebx, dword [ebp - 0x94]
jmp 0x448f61
mov dword [ebx], 1
mov dword [edi], 1
jmp 0x448f6f
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret