Function at 0x4039d4
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8134
call fcn.0041b6e0
mov eax, dword [0x4265d4]
xor eax, esp
mov dword [esp + 0x8130], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor ecx, ecx
push 7
pop esi
xor ebx, ebx
mov word [esp + 0x1c8], cx
mov word [esp + 0x388], cx
mov word [esp + 0x36c], cx
push eax
lea ecx, [esp + 0x2c8]
mov dword [esp + 0x1e0], esi
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x3a0], esi
mov dword [esp + 0x39c], ebx
mov dword [esp + 0x384], esi
mov dword [esp + 0x380], ebx
mov byte [esp + 0x23], bl
mov dword [esp + 0x2dc], 0xf
mov dword [esp + 0x2d8], ebx
mov byte [esp + 0x2c8], bl
call fcn.00402236
cmp dword [esp + 0x2d8], 0x10
mov ecx, dword [esp + 0x2c4]
mov eax, ecx
jae 0x403a85
lea eax, [esp + 0x2c4]
add eax, dword [esp + 0x2d4]
cmp dword [esp + 0x2d8], 0x10
jae 0x403a9d
lea ecx, [esp + 0x2c4]
push dword [esp + 0x28]
xor edx, edx
push eax
push ecx
lea eax, [esp + 0x2b4]
push eax
mov dword [esp + 0x2cc], esi
mov dword [esp + 0x2c8], ebx
mov word [esp + 0x2b8], dx
call fcn.00402911
lea esi, [esp + 0x2a8]
lea edi, [esp + 0x1c8]
call fcn.00401d32
push ebx
push 1
mov ecx, esi
call fcn.004013ba
push 5
push 0x4277e0
call fcn.004032b9
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
cmp si, bx
jne 0x403af6
sub ecx, edx
sar ecx, 1
push ecx
push eax
xor eax, eax
lea ecx, [esp + 0x1d0]
call fcn.0040131c
mov esi, eax
cmp esi, 0xffffffff
setne al
mov byte [0x477991], al
cmp al, bl
je 0x403bb3
lea ecx, [esp + 0x18c]
call fcn.00403526
mov ebx, eax
call fcn.00403351
push 0
push 1
lea ecx, [esp + 0x194]
call fcn.004013ba
push 0x423870
push 5
push esi
lea eax, [esp + 0x1d4]
push eax
call fcn.004054c8
push 0x40000
push 3
push 0x4276a8
call fcn.004032b9
push eax
push 7
push 0x4277ac
call fcn.004032b9
push eax
call fcn.00401e3a
push 0x11
push 0x4277bc
call fcn.004032b9
push eax
lea esi, [esp + 0x204]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
xor ebx, ebx
push 0xd8
call fcn.0040cc63
pop ecx
cmp eax, ebx
je 0x403bcf
call fcn.004072a0
mov ebx, eax
mov dword [esp + 0x24], ebx
jmp 0x403bd3
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x3dc]
call fcn.0040798c
lea eax, [ebx + 0xbc]
push eax
lea eax, [esp + 0x354]
call fcn.0040220e
lea eax, [ebx + 0xa0]
mov dword [esp + 0x28], eax
push eax
lea eax, [esp + 0x274]
call fcn.0040220e
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x204]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
cmp dword [esp + 0x364], 8
mov eax, dword [esp + 0x350]
jae 0x403c47
lea eax, [esp + 0x350]
push eax
push 0x10
push 0x427830
call fcn.004032b9
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x204]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
cmp byte [0x477991], 0
mov byte [esp + 0x13], 1
je 0x403d0a
cmp dword [esp + 0x1d8], 0
jbe 0x403d82
cmp dword [esp + 0x1dc], 8
mov eax, dword [esp + 0x1c8]
mov byte [esp + 0x13], 0
jae 0x403cc7
lea eax, [esp + 0x1c8]
push eax
push 0x20
push 0x427850
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x204]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
jmp 0x403d82
push 2
pop esi
push esi
push 0x4277ec
call fcn.004032b9
mov ecx, eax
lea edx, [ecx + 2]
mov bx, word [ecx]
add ecx, esi
test bx, bx
jne 0x403d1d
sub ecx, edx
sar ecx, 1
push ecx
push eax
xor eax, eax
lea ecx, [esp + 0x1d0]
call fcn.0040131c
push esi
push 0x4277f0
mov dword [esp + 0x20], eax
call fcn.004032b9
mov ecx, eax
lea edx, [ecx + 2]
mov bx, word [ecx]
add ecx, esi
test bx, bx
jne 0x403d4f
sub ecx, edx
sar ecx, 1
push ecx
push eax
xor eax, eax
lea ecx, [esp + 0x1d0]
call fcn.0040131c
cmp dword [esp + 0x18], 0xffffffff
je 0x403d7d
mov byte [esp + 0x13], bl
cmp eax, 0xffffffff
jne 0x403d82
mov byte [esp + 0x13], 1
push 1
call fcn.0040cc63
pop ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x3a4]
call fcn.00401c2b
cmp dword [esp + 0x3b4], 0
jbe 0x403da9
mov byte [esp + 0x1f], 1
cmp byte [esp + 0x13], 0
je 0x404584
cmp dword [esp + 0x284], 8
mov eax, dword [esp + 0x270]
jae 0x403dcc
lea eax, [esp + 0x270]
push eax
push 0x13
push 0x427890
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x220]
call fcn.00401249
mov ebx, esi
call fcn.00403351
xor ebx, ebx
push ebx
push 1
mov ecx, esi
call fcn.004013ba
push 0x423874
lea esi, [esp + 0x2ac]
call fcn.00401249
push ebx
push 0x422002
lea ecx, [esp + 0x208]
mov dword [esp + 0x21c], 0xf
mov dword [esp + 0x218], ebx
mov byte [esp + 0x208], bl
call fcn.00402257
cmp dword [esp + 0x284], 8
mov eax, dword [esp + 0x270]
jae 0x403e62
lea eax, [esp + 0x270]
push 0x80
push 3
push 3
push 0x80000000
push eax
call fcn.00401e6d
mov dword [esp + 0x18], eax
cmp eax, ebx
jne 0x403f7b
cmp dword [esp + 0x284], 8
mov eax, dword [esp + 0x270]
jae 0x403e9a
lea eax, [esp + 0x270]
push eax
push 0x17
push 0x4279e4
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x220]
call fcn.00401249
mov ebx, esi
call fcn.00403351
xor esi, esi
xor edi, edi
push esi
inc edi
push edi
mov ecx, ebx
call fcn.004013ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push edi
lea ecx, [esp + 0x208]
call fcn.004012d8
push esi
push edi
lea ecx, [esp + 0x2b0]
call fcn.004013ba
push 0x1f
pop ebx
push esi
push edi
lea ecx, [esp + 0x3ac]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x278]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x358]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x3e4]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x2cc]
call fcn.004012d8
push esi
push edi
lea ecx, [esp + 0x374]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x390]
call fcn.004013ba
push esi
push edi
lea ecx, [esp + 0x1d0]
call fcn.004013ba
mov eax, ebx
jmp 0x404ff3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x270]
push eax
lea edi, [esp + 0x34]
call fcn.004054f8
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
cmp dword [esp + ecx + 0x3c], ebx
jne 0x4045f7
lea ecx, [esp + ecx + 0x30]
mov eax, dword [ecx + 0x38]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x403fd3
push ebx
call fcn.004031d8
sub esp, 0x18
mov ecx, esp
lea eax, [esi - 0x3999]
cdq
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
lea ebx, [esp + 0x48]
mov dword [ecx], eax
mov dword [ecx + 4], edx
call fcn.00405122
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 4]
xor ebx, ebx
test byte [esp + eax + 0x3c], 6
jne 0x40401f
mov eax, dword [esp + eax + 0x68]
mov edx, dword [eax]
push 1
push 1
push ebx
push ebx
lea ecx, [esp + 0x1b8]
push ecx
mov ecx, eax
call dword [edx + 0x28]
lea eax, [esp + 0xe00]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00405048
xor eax, eax
mov word [esp + 0x1e4], ax
mov eax, 0x3999
lea ecx, [esp + 0xe00]
lea edx, [esp + 0x1e4]
mov dword [esp + 0x1f8], 7
mov dword [esp + 0x1f4], ebx
call fcn.0040149b
push ebx
lea eax, [esp + 0x1e8]
push eax
or eax, 0xffffffff
lea edi, [esp + 0x2b0]
call fcn.004065a9
lea eax, [esp + 0x48]
call fcn.00406a8b
test eax, eax
jne 0x4040b4
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x30]
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x4040a3
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x4040b4
push ebx
call fcn.004031d8
push ebx
push 1
lea ecx, [esp + 0x1ec]
call fcn.004013ba
push 0x423878
lea esi, [esp + 0x300]
call fcn.00401249
push 0x42387c
lea esi, [esp + 0x338]
call fcn.00401249
push 7
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 8
pop esi
push dword [esp + 0x28]
mov edi, dword [esp + 0x18]
xor eax, eax
mov word [esp + 0x290], ax
lea eax, [edi + 0x427eb6]
push eax
dec eax
push eax
lea eax, [esp + 0x298]
push eax
mov dword [esp + 0x2b0], esi
mov dword [esp + 0x2ac], ebx
call fcn.00406f4a
push dword [esp + 0x28]
xor eax, eax
mov word [esp + 0x1e8], ax
lea eax, [edi + 0x427f46]
push eax
lea eax, [edi + 0x427f45]
push eax
lea eax, [esp + 0x1f0]
push eax
mov dword [esp + 0x208], esi
mov dword [esp + 0x204], ebx
call fcn.00406f4a
push ebx
lea eax, [esp + 0x290]
push eax
or eax, 0xffffffff
lea edi, [esp + 0x304]
call fcn.004065a9
push ebx
lea eax, [esp + 0x1e8]
push eax
or eax, 0xffffffff
lea edi, [esp + 0x33c]
call fcn.004065a9
push ebx
push 1
lea ecx, [esp + 0x1ec]
call fcn.004013ba
push ebx
push 1
lea ecx, [esp + 0x294]
call fcn.004013ba
add dword [esp + 0x14], 2
dec dword [esp + 0x18]
jne 0x4040f4
cmp dword [esp + 0x310], 8
mov eax, dword [esp + 0x2fc]
jae 0x4041d6
lea eax, [esp + 0x2fc]
push dword [esp + 0x30c]
lea ecx, [esp + 0x2ac]
push eax
xor eax, eax
call fcn.0040131c
cmp dword [esp + 0x348], 8
mov edi, eax
mov eax, dword [esp + 0x334]
jae 0x404206
lea eax, [esp + 0x334]
push dword [esp + 0x344]
lea ecx, [esp + 0x2ac]
push eax
xor eax, eax
call fcn.0040131c
cmp edi, 0xffffffff
je 0x40451e
cmp eax, 0xffffffff
je 0x40451e
sub eax, dword [esp + 0x30c]
xor ecx, ecx
sub eax, edi
push eax
mov eax, dword [esp + 0x348]
add eax, edi
push eax
lea eax, [esp + 0x2b0]
lea edi, [esp + 0x224]
mov dword [esp + 0x238], esi
mov dword [esp + 0x234], ebx
mov word [esp + 0x224], cx
call fcn.004016a0
sub esp, 0x1c
mov ecx, edi
mov eax, esp
push ecx
call fcn.0040220e
lea eax, [esp + 0x1a8]
push eax
call fcn.0040211d
lea eax, [esp + 0x18c]
push eax
lea edi, [esp + 0xec]
call fcn.00405cd6
xor eax, eax
mov dword [esp + 0x1bc], esi
mov dword [esp + 0x1b8], ebx
mov word [esp + 0x1a8], ax
jmp 0x40449a
push 1
push str.:eu___
xor eax, eax
call fcn.0040131c
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x40447e
push dword [esp + 0x14]
xor eax, eax
mov word [esp + 0x1e8], ax
push ebx
lea eax, [esp + 0x1b0]
lea edi, [esp + 0x1ec]
mov dword [esp + 0x200], esi
mov dword [esp + 0x1fc], ebx
call fcn.004016a0
xor eax, eax
mov word [esp + 0x28c], ax
mov eax, dword [esp + 0x14]
inc eax
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x1b0]
lea edi, [esp + 0x294]
mov dword [esp + 0x2a8], esi
mov dword [esp + 0x2a4], ebx
call fcn.004016a0
push 0x423884
lea ecx, [esp + 0x1e8]
call fcn.00406ed9
test eax, eax
jne 0x40435c
push 0xffffffffffffffff
mov eax, edi
push ebx
lea edi, [esp + 0x374]
call fcn.004016a0
push 0x423888
lea ecx, [esp + 0x1e8]
call fcn.00406ed9
test eax, eax
jne 0x404387
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x294]
lea edi, [esp + 0x390]
call fcn.004016a0
push 0x42388c
push 1
push dword [esp + 0x1c]
lea eax, [esp + 0x1b4]
push eax
call fcn.004054c8
xor eax, eax
mov word [esp + 0x318], ax
mov eax, dword [esp + 0x1b8]
push 7
pop esi
inc eax
lea ecx, [esp + 0x318]
mov dword [esp + 0x32c], esi
mov dword [esp + 0x328], ebx
call fcn.004029ca
push 0x423894
lea eax, [esp + 0x31c]
push eax
call fcn.0040549d
push ebx
lea eax, [esp + 0x1ac]
push eax
or eax, 0xffffffff
lea edi, [esp + 0x320]
call fcn.004065a9
push 0x423890
mov eax, edi
push eax
call fcn.0040549d
mov dword [esp + 0x2f4], esi
xor ecx, ecx
mov esi, eax
lea edi, [esp + 0x2e0]
mov dword [esp + 0x2f0], ebx
mov word [esp + 0x2e0], cx
call fcn.00401d32
mov eax, edi
push ebx
push eax
or eax, 0xffffffff
lea edi, [esp + 0x1d0]
call fcn.004065a9
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x2e8]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x320]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x294]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x1ec]
call fcn.004013ba
push 7
pop esi
jmp 0x40449a
push 0x423898
lea ecx, [esp + 0x1ac]
call fcn.00406ed9
test eax, eax
jne 0x40449a
mov byte [0x477992], 1
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0xec]
push eax
call fcn.00406fa5
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
and al, 6
movsx eax, al
neg eax
sbb eax, eax
not eax
test ecx, eax
lea ecx, [esp + 0x1a8]
jne 0x4042b8
push ebx
push 1
call fcn.004013ba
lea ecx, [esp + 0x140]
call fcn.00405d54
lea eax, [esp + 0x140]
push eax
mov dword [esp + method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0040ba51
pop ecx
push ebx
push 1
lea ecx, [esp + 0x194]
call fcn.004013ba
push ebx
push 1
lea ecx, [esp + 0x224]
call fcn.004013ba
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x33c]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x304]
call fcn.004013ba
lea ecx, [esp + 0xa0]
call fcn.004055d0
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xa4], vtable.std::ios_base.0
call fcn.0040ba51
pop ecx
push ebx
push esi
lea ecx, [esp + 0x208]
call fcn.004012d8
push ebx
push esi
lea ecx, [esp + 0x2b0]
call fcn.004013ba
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [esp + 0x1d8], 0
jne 0x404617
push 0x4238ac
push 0x16
push 0x4278b8
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
push 0x2f
push 0x427908
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov eax, esi
call fcn.004035ae
push 0x2f
push 0x427908
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ecx, esi
call fcn.00403422
cmp dword [esp + 0x1dc], 8
mov eax, dword [esp + 0x1c8]
jae 0x40462f
lea eax, [esp + 0x1c8]
push eax
push 2
push 0x4275e4
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
cmp byte [0x477992], 0
jne 0x4048c7
cmp byte [0x477991], 0
jne 0x4048c7
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x358]
call fcn.00401aad
xor edi, edi
cmp dword [esp + 0x22c], edi
jbe 0x4046bd
lea ecx, [esp + 0x21c]
jmp 0x404612
lea eax, [esp + 0x18]
push eax
push 0x20019
push edi
push 0x19
push 0x427bf8
mov dword [esp + 0x2c], edi
call fcn.004032b9
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404708
push 0x32
push 0x427b88
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ecx, esi
jmp 0x404612
push 0x12
xor eax, eax
push 0x427c2c
mov dword [esp + 0x200], 7
mov dword [esp + 0x1fc], edi
mov word [esp + 0x1ec], ax
call fcn.004032b9
push eax
lea esi, [esp + 0x2e4]
call fcn.00401249
push 0x20
push 0x427c50
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov eax, esi
push eax
lea edx, [esp + 0x1e8]
lea ecx, [esp + 0x2e4]
call fcn.004070f2
push edi
push 1
lea ecx, [esp + 0x194]
mov esi, eax
call fcn.004013ba
push edi
push 1
lea ecx, [esp + 0x2e8]
call fcn.004013ba
cmp esi, edi
jne 0x404873
push 6
push 0x427c90
call fcn.004032b9
push eax
lea esi, [esp + 0x1ac]
call fcn.00401249
cmp dword [esp + 0x1bc], 8
mov esi, dword [esp + 0x1a8]
mov edi, esi
jae 0x40485a
lea edi, [esp + 0x1a8]
mov eax, edi
cmp dword [esp + 0x1bc], 8
mov ecx, dword [esp + 0x1b8]
lea ebx, [eax + ecx*2]
jae 0x4047e8
lea esi, [esp + 0x1a8]
cmp esi, ebx
je 0x404803
sub edi, esi
movzx eax, word [esi]
push eax
call fcn.0040db4e
mov word [edi + esi], ax
add esi, 2
pop ecx
cmp esi, ebx
jne 0x4047ee
cmp dword [esp + 0x1bc], 8
mov eax, dword [esp + 0x1a8]
jae 0x40481b
lea eax, [esp + 0x1a8]
mov edi, dword [esp + 0x1b8]
push eax
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1e8]
call fcn.00406f06
test eax, eax
jne 0x404861
push 0x32
push 0x427b88
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ecx, esi
jmp 0x404612
mov eax, esi
jmp 0x4047cd
push 0
push 1
lea ecx, [esp + 0x1b0]
call fcn.004013ba
xor edi, edi
push edi
push 1
lea ecx, [esp + 0x1ec]
call fcn.004013ba
push edi
push 1
lea ecx, [esp + 0x224]
call fcn.004013ba
cmp byte [0x477991], 0
jne 0x4048c7
mov ebx, dword [esp + 0x24]
call fcn.00407b01
test al, al
jne 0x4048c7
push 0x32
push 0x427b88
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ecx, esi
jmp 0x404612
push 0x4238b0
lea esi, [esp + 0x258]
call fcn.00401249
lea eax, [esp + 0xbf8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404921
lea eax, [esp + 0xbf8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov esi, eax
lea edi, [esp + 0x254]
call fcn.00401d32
push 0
push 1
lea ecx, [esp + 0x194]
call fcn.004013ba
lea edx, [esp + 0x254]
lea ecx, [esp + 0x18c]
call fcn.00407f28
mov esi, eax
lea edi, [esp + 0x254]
call fcn.00401d32
push 0
push 1
lea ecx, [esp + 0x194]
call fcn.004013ba
cmp dword [esp + 0x268], 8
mov esi, dword [esp + 0x254]
jae 0x404965
mov esi, edi
push 0x10
push 0x4284e4
call fcn.00401dcd
push eax
push 8
push 0x4281c4
call fcn.00401d81
push eax
call fcn.00401e13
push 0
push esi
call eax
test eax, eax
jne 0x4049d8
push 0x17
push 0x427968
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
push 0x25
push 0x427998
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov eax, esi
jmp 0x4045f2
lea edx, [esp + 0x254]
lea ecx, [esp + 0x238]
call fcn.00408208
cmp dword [esp + 0x24c], 8
mov eax, dword [esp + 0x238]
jae 0x404a03
lea eax, [esp + 0x238]
push eax
push 0x11
push 0x4278e4
call fcn.004032b9
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
cmp byte [esp + 0x1f], 0
je 0x404a97
mov eax, 0x31a52
push eax
mov dword [esp + 0x1c], eax
call fcn.0040b846
xor esi, esi
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
mov ebx, dword [esi + 0x4763b0]
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x14]
push ebx
push dword [esi + 0x476408]
push eax
call fcn.0040f200
add dword [esp + 0x2c], ebx
add esi, 4
add esp, 0xc
cmp esi, 0x54
jl 0x404a6b
jmp 0x404adb
mov eax, 0x1c319
push eax
mov dword [esp + 0x1c], eax
call fcn.0040b846
xor esi, esi
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
mov ebx, dword [esi + 0x427d84]
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x14]
push ebx
push dword [esi + 0x427e1c]
push eax
call fcn.0040f200
add dword [esp + 0x2c], ebx
add esi, 4
add esp, 0xc
cmp esi, 0x2c
jl 0x404ab1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x14]
call fcn.004035db
test al, al
jne 0x404b0c
push 0x2f
push 0x427908
call fcn.004032b9
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ecx, esi
jmp 0x404612
cmp dword [esp + 0x24c], 8
mov eax, dword [esp + 0x238]
jae 0x404b24
lea eax, [esp + 0x238]
push 0x100
push 2
push 1
push 0x40000000
push eax
call fcn.00401e6d
mov esi, eax
test esi, esi
jne 0x404bcb
cmp dword [esp + 0x24c], 8
mov eax, dword [esp + 0x238]
jae 0x404b5a
lea eax, [esp + 0x238]
push eax
push 0x17
push 0x4279e4
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
xor esi, esi
push esi
push 1
mov ecx, ebx
call fcn.004013ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 1
lea ecx, [esp + 0x240]
call fcn.004013ba
push esi
push 1
lea ecx, [esp + 0x25c]
call fcn.004013ba
xor edi, edi
push 0xd
inc edi
jmp 0x403f03
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404bec
mov edi, esi
call fcn.004034bc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call fcn.0040e0e3
cmp dword [esp + 0x250], 8
mov eax, dword [esp + 0x23c]
pop ecx
jae 0x404c15
lea eax, [esp + 0x238]
push eax
push 0x14
push 0x427a14
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
push 8
push 0x427a3c
call fcn.004032b9
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x404c67
sub ecx, edx
sar ecx, 1
push eax
mov ebx, ecx
lea eax, [esp + 0x1cc]
call fcn.004067ec
cmp byte [0x477991], 0
mov ebx, 0x4275e0
je 0x404d4f
lea eax, [esp + 0x3dc]
push eax
lea eax, [esp + 0x204]
call fcn.0040220e
push 3
push 0x4277f4
call fcn.004032b9
push eax
lea esi, [esp + 0x220]
call fcn.00401249
push 0x4238b4
mov eax, esi
push eax
call fcn.0040549d
push 1
push ebx
call fcn.004032b9
push eax
mov eax, esi
push eax
call fcn.0040549d
push 0
mov eax, esi
push eax
or eax, 0xffffffff
lea edi, [esp + 0x208]
call fcn.004066de
push 7
push 0x4275f0
call fcn.004032b9
push eax
mov eax, edi
push eax
call fcn.0040549d
push 1
push ebx
call fcn.004032b9
push eax
mov eax, edi
push eax
call fcn.0040549d
xor esi, esi
mov eax, edi
push esi
push eax
or eax, 0xffffffff
lea edi, [esp + 0x1d0]
call fcn.004065a9
push esi
push 1
lea ecx, [esp + 0x224]
call fcn.004013ba
push esi
push 1
lea ecx, [esp + 0x208]
call fcn.004013ba
push 3
push 0x4277fc
call fcn.004032b9
push eax
lea esi, [esp + 0x3c4]
call fcn.00401249
push 0x4238b8
mov eax, esi
push eax
call fcn.0040549d
push 0
mov eax, esi
push eax
or eax, 0xffffffff
lea edi, [esp + 0x1d0]
call fcn.004065a9
push 1
push ebx
call fcn.004032b9
push eax
mov eax, edi
push eax
call fcn.0040549d
push dword [esp + 0x28]
lea eax, [esp + 0x190]
call fcn.0040220e
push 0
lea eax, [esp + 0x190]
push eax
or eax, 0xffffffff
call fcn.004065a9
push 0
push 1
lea ecx, [esp + 0x194]
call fcn.004013ba
push 1
push ebx
call fcn.004032b9
push eax
mov eax, edi
push eax
call fcn.0040549d
mov eax, edi
push eax
lea edx, [esp + 0x23c]
lea ecx, [esp + 0x258]
call fcn.004037a1
test al, al
je 0x404e4a
push 0x4238bc
push 0x17
push 0x427a4c
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x194]
call fcn.004013ba
jmp 0x404e98
push 0x4238c0
push 0x10
push 0x427a7c
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
xor esi, esi
xor ebx, ebx
inc esi
cmp byte [0x477991], bl
je 0x404ef8
cmp dword [esp + 0x268], 8
mov eax, dword [esp + 0x254]
jae 0x404eb8
lea eax, [esp + 0x254]
push eax
push 0x2d
push 0x427ac8
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40000
push 3
push 0x4276a8
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call fcn.00401e3a
jmp 0x404f57
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x254]
push eax
call fcn.00408010
push 0x4238c4
push 0x16
push 0x427a9c
call fcn.004032b9
push eax
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x3f8]
push eax
lea esi, [esp + 0x190]
call fcn.00401249
mov ebx, esi
call fcn.00403351
push 0
push 1
mov ecx, esi
call fcn.004013ba
xor esi, esi
xor ebx, ebx
inc esi
push ebx
push esi
lea ecx, [esp + 0x3c8]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x240]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x25c]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x3ac]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x278]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x358]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x3e4]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x2cc]
call fcn.004012d8
push ebx
push esi
lea ecx, [esp + 0x374]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x390]
call fcn.004013ba
push ebx
push esi
lea ecx, [esp + 0x1d0]
call fcn.004013ba
xor eax, eax
mov ecx, dword [esp + 0x813c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c44c
mov esp, ebp
pop ebp
ret 0x10