Function at 0x474f90
Capabilities:
Encode data using base64
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4eb241
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x658
push ebx
push esi
lea eax, [ebp + 8]
push edi
push eax
mov dword [esp + 0x188], ecx
call fcn.00443850
push 0xc
call fcn.00449130
xor edi, edi
add esp, 8
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x474fdb
mov word [eax], di
push 0x2a
mov dword [esp + 0x670], edi
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x20], eax
je 0x474ff7
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x47500c
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x475021
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x475036
mov word [eax], di
mov ecx, dword [ebp + 8]
or esi, 0xffffffff
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x678], 4
mov dword [esp + 0xcc], 0xfffc0000
mov dword [esp + 0x3c], edi
mov dword [esp + 0x194], edi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xdc], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0xc8], edi
mov dword [esp + 0x164], esi
mov dword [esp + 0x168], esi
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], esi
mov dword [esp + 0x178], esi
mov byte [esp + 0xb2], 0
mov byte [esp + 0x93], 0
mov byte [esp + 0xff], 0
mov byte [esp + 0xfd], 0
mov byte [esp + 0x43], 0
mov byte [esp + 0x7b], 0
mov byte [esp + 0x92], 0
mov byte [esp + 0xb3], 0
mov dword [esp + 0x88], ecx
call fcn.0044c770
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
add esp, 0xc
mov word [ecx], di
cmp word [eax], 0x2c
jne 0x475139
mov word [eax], di
add eax, 2
push 0x2c
lea edx, [esp + 0x1c]
mov dword [esp + 0x80], eax
push edx
lea eax, [esp + 0x84]
push eax
call fcn.0044c770
add esp, 0xc
mov dword [esp + 0xdc], esi
mov dword [esp + 0xcc], esi
mov dword [esp + 0x1fc], esi
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, di
mov byte [esp + 0x53], 0
mov byte [esp + 0x6d], 0
mov byte [esp + 0xd7], 0
mov byte [esp + 0x5f], 0
mov byte [esp + 0xa4], 0
mov byte [esp + 0xf2], 0
mov byte [esp + 0x6e], 0
mov byte [esp + 0x2f], 0
mov byte [esp + 0x2e], 0
mov byte [esp + 0x36], 0
mov byte [esp + 0x43], 0
mov byte [esp + 0xa3], 0
mov byte [esp + 0x8f], 0
mov dword [esp + 0x94], edi
mov dword [esp + 0xec], edi
mov dword [esp + 0xa8], edi
mov byte [esp + 0x190], 0
mov dword [esp + 0xc4], 0xfffff000
mov dword [esp + 0xd8], 0xfffffff7
mov dword [esp + 0xc8], 0xfffffff7
je 0x475dcb
jmp 0x4751f0
mov eax, esi
mov ecx, str._admin
mov edx, 5
lea esp, [esp]
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x475267
dec edx
jns 0x475200
mov ax, word [eax]
cmp ax, 9
jb 0x475226
cmp ax, 0xd
jbe 0x475231
cmp ax, 0x20
je 0x475231
test ax, ax
jne 0x475267
add esi, 0xc
mov dword [ebp + 8], esi
je 0x47525d
lea esp, [esp]
mov ax, word [esi]
cmp ax, 9
jb 0x47524f
cmp ax, 0xd
jbe 0x475255
cmp ax, 0x20
jne 0x47525d
add esi, 2
mov dword [ebp + 8], esi
jmp 0x475240
or byte [esp + 0x53], 1
jmp 0x4759a3
push 6
push esi
push str._super
call fcn.00444970
add esp, 0xc
test al, al
je 0x4752aa
add esi, 0xc
mov dword [ebp + 8], esi
je 0x4752a0
mov ax, word [esi]
cmp ax, 9
jb 0x475292
cmp ax, 0xd
jbe 0x475298
cmp ax, 0x20
jne 0x4752a0
add esi, 2
mov dword [ebp + 8], esi
jmp 0x475283
or byte [esp + 0x53], 2
jmp 0x4759a3
push 6
push esi
push str._devid
call fcn.00444970
add esp, 0xc
test al, al
je 0x4752f3
add esi, 0xc
mov dword [ebp + 8], esi
je 0x4752e3
mov ax, word [esi]
cmp ax, 9
jb 0x4752d5
cmp ax, 0xd
jbe 0x4752db
cmp ax, 0x20
jne 0x4752e3
add esi, 2
mov dword [ebp + 8], esi
jmp 0x4752c6
or dword [esp + 0x188], 0x10000
jmp 0x4759a3
push 7
push esi
push str._devidx
call fcn.00444970
add esp, 0xc
test al, al
je 0x475331
lea ecx, [ebp + 8]
add esi, 0xe
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0x18c]
add esp, 4
or eax, 0x20000
mov dword [esp + 0x188], eax
jmp 0x4759a0
push 4
push esi
push str._gui
call fcn.00444970
add esp, 0xc
test al, al
jne 0x475cab
push 4
push esi
push str._usb
call fcn.00444970
add esp, 0xc
test al, al
je 0x475371
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
jmp 0x47599d
push 6
push esi
push str._hextp
call fcn.00444970
add esp, 0xc
test al, al
je 0x4753ad
lea eax, [ebp + 8]
add esi, 0xc
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0xac]
add esp, 4
or eax, 1
mov dword [esp + 0xa8], eax
jmp 0x4759a0
push 4
push esi
push str._phy
call fcn.00444970
add esp, 0xc
test al, al
je 0x4753e9
lea ecx, [ebp + 8]
add esi, 8
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0xac]
add esp, 4
or eax, 2
mov dword [esp + 0xa8], eax
jmp 0x4759a0
push 5
push esi
push 0x4fa72c
call fcn.00444970
add esp, 0xc
test al, al
je 0x475425
lea edx, [ebp + 8]
add esi, 0xa
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0xac]
add esp, 4
or eax, 0x10
mov dword [esp + 0xa8], eax
jmp 0x4759a0
push 5
push esi
push str._fill
call fcn.00444970
add esp, 0xc
test al, al
je 0x475461
lea eax, [ebp + 8]
add esi, 0xa
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0xac]
add esp, 4
or eax, 4
mov dword [esp + 0xa8], eax
jmp 0x4759a0
push 3
push esi
push 0x4fa720
call fcn.00444970
add esp, 0xc
test al, al
je 0x47548e
lea ecx, [ebp + 8]
add esi, 6
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x32], 1
jmp 0x47599d
push 4
push esi
push str._hup
call fcn.00444970
add esp, 0xc
test al, al
je 0x4754bb
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x3a], 1
jmp 0x47599d
push 5
push esi
push str._ahup
call fcn.00444970
add esp, 0xc
test al, al
je 0x4754e8
lea eax, [ebp + 8]
add esi, 0xa
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x3a], 0x21
jmp 0x47599d
push 4
push esi
push str._gpt
call fcn.00444970
add esp, 0xc
test al, al
je 0x475515
lea ecx, [ebp + 8]
add esi, 8
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x47], 1
jmp 0x47599d
push 4
push esi
push str._mbr
call fcn.00444970
add esp, 0xc
test al, al
je 0x475545
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0xf5], 1
jmp 0x47599d
push 4
push esi
push str._cmp
call fcn.00444970
add esp, 0xc
test al, al
je 0x475575
lea eax, [ebp + 8]
add esi, 8
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0xa7], 1
jmp 0x47599d
push 6
push esi
push 0x4f6d9c
call fcn.00444970
add esp, 0xc
test al, al
je 0x4755a5
lea ecx, [ebp + 8]
add esi, 0xc
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0xf7], 1
jmp 0x47599d
push 3
push esi
push 0x4fa6f4
call fcn.00444970
add esp, 0xc
test al, al
je 0x4755d5
lea edx, [ebp + 8]
add esi, 6
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0xab], 1
jmp 0x47599d
push 6
push esi
push str._lskip
call fcn.00444970
add esp, 0xc
test al, al
je 0x475610
lea eax, [ebp + 8]
add esi, 0xc
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov al, byte [esp + 0x8a]
add esp, 4
or al, 0x40
mov byte [esp + 0x86], al
jmp 0x4759a0
push 5
push esi
push str._lock
call fcn.00444970
add esp, 0xc
test al, al
je 0x47563d
lea ecx, [ebp + 8]
add esi, 0xa
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x73], 1
jmp 0x47599d
push 6
push esi
push str._lock_
call fcn.00444970
add esp, 0xc
test al, al
je 0x47566a
lea edx, [ebp + 8]
add esi, 0xc
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x73], 0xff
jmp 0x47599d
push 4
push esi
push 0x4fa6d4
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475711
lea ecx, [esi + 8]
xor eax, eax
mov ax, word [ecx]
test ax, ax
je 0x47569e
cmp ax, 0x3d
je 0x47569e
call fcn.00443830
test al, al
je 0x475711
mov eax, ecx
mov dword [ebp + 8], eax
cmp word [eax], 0x3d
mov dword [esp + 0xec], 0
je 0x4756cd
lea eax, [ebp + 8]
push eax
mov dword [esp + 0x98], 0x4fa6cc
call fcn.00443850
jmp 0x47599d
add eax, 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.00443850
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
mov dword [esp + 0x9c], ecx
call fcn.00417de5
mov eax, dword [ebp + 8]
add esp, 8
cmp word [eax], 0
je 0x475703
mov word [eax], 0
add dword [ebp + 8], 2
lea eax, [ebp + 8]
push eax
call fcn.00443850
jmp 0x47599d
push 4
push esi
push str._pbr
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4757c4
lea ecx, [esi + 8]
xor eax, eax
mov ax, word [ecx]
test ax, ax
je 0x475745
cmp ax, 0x3d
je 0x475745
call fcn.00443830
test al, al
je 0x4757c4
mov eax, ecx
mov dword [ebp + 8], eax
cmp word [eax], 0x3d
mov dword [esp + 0x94], 0
je 0x475780
lea ecx, [ebp + 8]
push ecx
mov dword [esp + 0xf0], 0x4f004f
call fcn.00417de5
add esp, 4
lea edx, [ebp + 8]
push edx
call fcn.00443850
jmp 0x47599d
lea edx, [ebp + 8]
add eax, 2
push edx
mov dword [ebp + 8], eax
call fcn.00443850
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov dword [esp + 0xf4], eax
call fcn.00417de5
mov eax, dword [ebp + 8]
add esp, 8
cmp word [eax], 0
je 0x4757b6
mov word [eax], 0
add dword [ebp + 8], 2
lea edx, [ebp + 8]
push edx
call fcn.00443850
jmp 0x47599d
push 9
push esi
push str._alignend
call fcn.004449d0
add esp, 0xc
test al, al
je 0x47587c
lea ecx, [esi + 0x12]
xor eax, eax
mov ax, word [ecx]
test ax, ax
je 0x4757fc
cmp ax, 0x3d
je 0x4757fc
call fcn.00443830
test al, al
je 0x47587c
mov dword [ebp + 8], ecx
cmp word [ecx], 0x3d
jne 0x47584c
mov ax, word [ecx + 2]
add ecx, 2
call fcn.0043af40
test al, al
je 0x475862
lea eax, [esp + 0xc8]
mov dword [esp + 0xe4], ecx
push eax
lea ecx, [esp + 0xe8]
push ecx
call fcn.0044f5a0
mov eax, dword [esp + 0xd4]
add esp, 8
test eax, eax
jg 0x475862
jl 0x47584c
mov eax, dword [esp + 0xc8]
test eax, eax
ja 0x475862
mov dword [esp + 0xc8], 0xfffffffe
mov dword [esp + 0xcc], 0xffffffff
lea edx, [ebp + 8]
push edx
call fcn.00417de5
lea eax, [ebp + 8]
push eax
call fcn.00443850
add esp, 8
jmp 0x4759a0
push 6
push esi
push str._align
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475948
lea ecx, [esi + 0xc]
xor eax, eax
mov ax, word [ecx]
test ax, ax
je 0x4758b4
cmp ax, 0x3d
je 0x4758b4
call fcn.00443830
test al, al
je 0x475948
mov dword [ebp + 8], ecx
mov esi, ecx
lea ecx, [ebp + 8]
push ecx
call fcn.00417de5
lea edx, [ebp + 8]
push edx
call fcn.00443850
add esp, 8
cmp word [esi], 0x3d
je 0x4758ea
or eax, 0xffffffff
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
jmp 0x4759a0
mov ax, word [esi + 2]
add esi, 2
call fcn.0043af40
test al, al
je 0x4759a0
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0xe8]
push ecx
mov dword [esp + 0xec], esi
call fcn.0044f5a0
mov eax, dword [esp + 0xe4]
add esp, 8
test eax, eax
jg 0x4759a0
jl 0x475935
mov eax, dword [esp + 0xd8]
test eax, eax
ja 0x4759a0
or eax, 0xffffffff
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
jmp 0x4759a0
push 6
push esi
push str._clear
call fcn.00444970
add esp, 0xc
test al, al
je 0x475975
lea edx, [ebp + 8]
add esi, 0xc
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0xdb], 1
jmp 0x47599d
push 3
push esi
push 0x4f5c80
call fcn.00444970
add esp, 0xc
test al, al
je 0x4759fd
add esi, 6
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
call fcn.00443850
mov byte [esp + 0x63], 1
add esp, 4
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x4751f0
mov eax, dword [esp + 0xc8]
or edi, 0xffffffff
cmp eax, 0xfffffffe
jne 0x475db6
cmp dword [esp + 0xcc], edi
jne 0x475db6
mov eax, dword [esp + 0xd8]
cmp eax, 0xfffffff7
jne 0x475d9f
cmp dword [esp + 0xdc], edi
jne 0x475d9f
mov dword [esp + 0xc8], edi
mov dword [esp + 0xcc], edi
jmp 0x475dcb
push 4
push esi
push str._del
call fcn.00444970
add esp, 0xc
test al, al
je 0x475a20
add esi, 8
lea ecx, [ebp + 8]
mov dword [ebp + 8], esi
push ecx
jmp 0x475993
push 4
push esi
push str._raw
call fcn.00444970
add esp, 0xc
test al, al
je 0x475a64
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov eax, dword [esp + 0xac]
add esp, 4
or eax, 0x20
mov byte [esp + 0xa4], 1
mov dword [esp + 0xa8], eax
jmp 0x4759a0
push 6
push esi
push str._swap:
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475b30
lea eax, [esp + 0xc4]
push eax
lea ecx, [ebp + 8]
add esi, 0xc
push ecx
mov dword [ebp + 8], esi
call fcn.0044ce90
add esp, 8
test eax, eax
jl 0x475aaf
mov eax, dword [esp + 0xc4]
cmp eax, 1
jl 0x475aaf
cmp eax, 4
jle 0x4759a0
mov eax, dword [esp + 0x10]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x475acc
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x475ae3
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x475af9
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x475b10
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4776ba
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
jmp 0x4776ba
push 5
push esi
push str._CHS
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475be4
lea edx, [ebp + 8]
add esi, 0xa
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
mov dword [esp + 0x4c], esi
call fcn.00417e2a
mov ax, word [esi]
add esp, 8
call fcn.0043af40
test al, al
je 0x475b8f
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.0044f5a0
mov esi, dword [esp + 0x4c]
add esp, 8
cmp word [esi], 0x3a
jne 0x4759a0
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x48]
add esi, 2
push ecx
mov dword [esp + 0x4c], esi
call fcn.0044f5a0
mov esi, dword [esp + 0x4c]
add esp, 8
cmp word [esi], 0x3a
jne 0x4759a0
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x48]
add esi, 2
push eax
mov dword [esp + 0x4c], esi
call fcn.0044f5a0
add esp, 8
jmp 0x4759a0
push 5
push esi
push str._IMG
call fcn.004449d0
add esp, 0xc
test al, al
jne 0x4759ad
push 6
push esi
push str._SKIP
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475c51
lea ecx, [ebp + 8]
add esi, 0xc
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
lea edx, [esp + 0x9c]
push edx
lea eax, [ebp + 8]
push eax
mov dword [esp + 0xa4], 0x42
call fcn.0044ce90
mov cl, byte [esp + 0xa4]
add esp, 0xc
mov byte [esp + 0x190], cl
jmp 0x4759a0
push 4
push esi
push str._iv
call fcn.004449d0
add esp, 0xc
test al, al
je 0x475c84
lea edx, [esp + 0x1fc]
push edx
lea eax, [ebp + 8]
add esi, 8
push eax
mov dword [ebp + 8], esi
call fcn.0044ce90
add esp, 8
jmp 0x4759a0
mov ax, word [esi]
cmp ax, 0x2d
jne 0x4759ad
lea ecx, [ebp + 8]
push ecx
call fcn.00417de5
lea edx, [ebp + 8]
push edx
call fcn.00443850
add esp, 8
jmp 0x4759a0
lea eax, [ebp + 8]
add esi, 8
push eax
mov dword [ebp + 8], esi
call fcn.00443850
add esp, 4
push str.21:INDATA
lea ecx, [esp + 0x9c]
call fcn.004134f5
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x9c]
mov byte [esp + 0x670], 5
call fcn.00449510
mov esi, dword [esp + 0x98]
mov ecx, dword [esp + 0x184]
push esi
call fcn.00433888
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, eax
je 0x475d15
mov ecx, dword [0x51d3c8]
add esi, 0xfffffff8
push esi
push 0
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x475d2c
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x475d42
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x475d59
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x475d70
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x475d86
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
mov eax, ebx
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
jmp 0x475dbd
mov eax, dword [esp + 0xd8]
cmp eax, 0xfffffff7
jne 0x475de7
cmp dword [esp + 0xdc], edi
jne 0x475de7
mov ebx, 1
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], 0
or edi, 0xffffffff
jmp 0x475dec
mov ebx, 1
cmp dword [esp + 0xc8], 0xfffffff7
jne 0x475e1b
cmp dword [esp + 0xcc], edi
jne 0x475e1b
mov edx, dword [esp + 0xd8]
mov eax, dword [esp + 0xdc]
mov dword [esp + 0xc8], edx
mov dword [esp + 0xcc], eax
push 4
push esi
push str.list
call fcn.00444970
add esp, 0xc
test al, al
je 0x475ec7
lea ecx, [ebp + 8]
add esi, 8
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov esi, dword [ebp + 8]
push 4
push esi
push str.disk
call fcn.00444970
add esp, 0x10
test al, al
je 0x475e6f
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x71], 1
jmp 0x475ec1
push 4
push esi
push str.part
call fcn.00444970
add esp, 0xc
test al, al
je 0x475e99
lea eax, [ebp + 8]
add esi, 8
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x71], 2
jmp 0x475ec1
push 3
push esi
push 0x4fa654
call fcn.00444970
add esp, 0xc
test al, al
je 0x475ec7
lea ecx, [ebp + 8]
add esi, 6
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov byte [esp + 0x71], 3
mov esi, dword [ebp + 8]
add esp, 4
push 4
push esi
push str.init
mov byte [esp + 0x73], 0
call fcn.00444970
add esp, 0xc
test al, al
je 0x475efe
lea edx, [ebp + 8]
add esi, 8
push edx
mov dword [ebp + 8], esi
call fcn.00443850
mov esi, dword [ebp + 8]
add esp, 4
mov byte [esp + 0x37], 1
mov dword [esp + 0x30], ebx
push 6
push esi
push str.update
call fcn.00444970
add esp, 0xc
test al, al
je 0x475f30
lea eax, [ebp + 8]
add esi, 0xc
push eax
mov dword [ebp + 8], esi
call fcn.00443850
mov esi, dword [ebp + 8]
add esp, 4
mov byte [esp + 0x67], 1
mov dword [esp + 0x30], ebx
push 7
push esi
push str.hupdate
call fcn.00444970
add esp, 0xc
test al, al
je 0x475f62
lea ecx, [ebp + 8]
add esi, 0xe
push ecx
mov dword [ebp + 8], esi
call fcn.00443850
mov esi, dword [ebp + 8]
add esp, 4
mov byte [esp + 0x67], 0x10
mov dword [esp + 0x30], ebx
lea edx, [ebp + 8]
push edx
call fcn.00417de5
mov eax, dword [ebp + 8]
sub eax, esi
add esp, 4
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00449600
lea ecx, [ebp + 8]
push ecx
call fcn.00443850
mov ecx, dword [ebp + 8]
xor eax, eax
mov ax, word [ecx]
add esp, 4
mov edx, eax
or edx, 0x20
cmp dx, 0x61
jne 0x475fb0
lea eax, [ebp + 8]
mov dword [esp + 0x90], 0x80
push eax
jmp 0x475fd3
cmp ax, 0x2d
jne 0x475fdb
mov cx, word [ecx + 2]
or cx, 0x20
cmp cx, 0x61
jne 0x475fdb
lea edx, [ebp + 8]
mov dword [esp + 0x90], 0
push edx
call fcn.00417de5
add esp, 4
xor ecx, ecx
xor eax, eax
push 0x51d604
mov dword [esp + 0x1c8], 0xebd0a0a2
mov word [esp + 0x1cc], 0xb9e5
mov word [esp + 0x1ce], 0x4433
mov byte [esp + 0x1d0], 0x87
mov byte [esp + 0x1d1], 0xc0
mov byte [esp + 0x1d2], 0x68
mov byte [esp + 0x1d3], 0xb6
mov byte [esp + 0x1d4], 0xb7
mov byte [esp + 0x1d5], 0x26
mov byte [esp + 0x1d6], 0x99
mov byte [esp + 0x1d7], 0xc7
mov dword [esp + 0x21c], ecx
mov dword [esp + 0x228], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x214], ecx
mov dword [esp + 0x218], ecx
mov dword [esp + 0x1ac], ecx
mov dword [esp + 0x1c4], ecx
mov dword [esp + 0x134], str.MS_Basic_Data
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x198], ecx
mov dword [esp + 0x1c0], ecx
mov dword [esp + 0x28], 0x51d604
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [esp + 0x43]
test bl, bl
mov byte [esp + 0x66c], 6
jne 0x4760fd
lea eax, [esp + 0xd0]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.0044ce90
mov eax, dword [ebp + 8]
add esp, 8
cmp word [eax], 0x2d
jne 0x47612f
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x4760ed
cmp cx, 0x39
jbe 0x47612f
add eax, 2
mov byte [esp + 0xf2], 1
mov dword [ebp + 8], eax
jmp 0x47612f
lea edx, [esp + 0x1c4]
push edx
lea eax, [ebp + 8]
push eax
call fcn.0045f7e0
add esp, 8
cmp eax, edi
mov dword [esp + 0x1d4], eax
jne 0x47612c
push 0x51d604
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x47a140
mov eax, dword [ebp + 8]
cmp word [eax], 0x2b
jne 0x476144
mov cl, byte [eax]
add eax, 2
mov byte [esp + 0xa6], cl
mov dword [ebp + 8], eax
cmp word [eax], 0x2d
lea edx, [ebp + 8]
jne 0x47615e
push edx
call fcn.00417de5
lea eax, [ebp + 8]
push eax
call fcn.00443850
jmp 0x476170
lea ecx, [esp + 0x38]
push ecx
push edx
call fcn.0044f680
mov dword [esp + 0x19c], eax
mov eax, dword [ebp + 8]
add esp, 8
cmp word [eax], 0x40
mov byte [esp + 0xe2], 1
jne 0x476192
add eax, 2
mov dword [ebp + 8], eax
mov byte [esp + 0xe2], 0
cmp word [eax], 0x2d
lea eax, [ebp + 8]
jne 0x4761ac
push eax
call fcn.00417de5
lea ecx, [ebp + 8]
push ecx
call fcn.00443850
jmp 0x4761be
lea edx, [esp + 0x48]
push edx
push eax
call fcn.0044f680
mov dword [esp + 0x1c4], eax
add esp, 8
test bl, bl
je 0x4761f8
lea ecx, [esp + 0x218]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.0045f7e0
mov dword [esp + 0x1b4], eax
lea eax, [esp + 0x218]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.0044f5a0
add esp, 0x10
mov dword [esp + 0x1a8], eax
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x1f4], esi
mov ax, word [ecx]
cmp ax, 0x2d
je 0x47625a
test bl, bl
je 0x47625a
cmp ax, si
je 0x47625a
push esi
lea edx, [esp + 0x1f8]
push edx
lea eax, [esp + 0x200]
push eax
mov dword [esp + 0x204], ecx
call fcn.00428699
mov eax, dword [esp + 0x204]
mov ecx, dword [esp + 0x200]
add esp, 0xc
mov dword [esp + 0x1c0], 1
mov dword [esp + 0x130], eax
mov word [eax + ecx*2], si
cmp byte [esp + 0x6d], 1
mov byte [esp + 0xb1], 0
mov byte [esp + 0xa5], 0
je 0x476278
mov dword [esp + 0xc0], esi
mov edi, dword [esp + 0x1c]
push 5
push edi
mov esi, edi
push str._img
mov dword [ebp + 8], esi
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4762fa
lea ecx, [edi + 0xa]
mov dword [ebp + 8], ecx
mov ax, word [ecx]
test ax, ax
mov edx, ecx
je 0x4762cb
cmp ax, 9
jb 0x4762b1
cmp ax, 0xd
jbe 0x4762cb
cmp ax, 0x20
je 0x4762cb
cmp ax, 0x23
je 0x4762cb
add ecx, 2
mov dword [ebp + 8], ecx
mov ax, word [ecx]
test ax, ax
jne 0x4762a5
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4762e9
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00449600
mov dword [esp + 0xc0], 0xfffc0000
lea edx, [ebp + 8]
push edx
call fcn.00443850
mov esi, dword [ebp + 8]
add esp, 4
jmp 0x476346
push 2
push edi
push 0x4fa614
call fcn.004449d0
add esp, 0xc
test al, al
je 0x476314
lea esi, [edi + 4]
mov dword [ebp + 8], esi
mov ax, word [esi]
cmp ax, 0x30
jb 0x47633a
cmp ax, 0x39
ja 0x47633a
lea eax, [esp + 0xc0]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.0044ce90
mov esi, dword [ebp + 8]
add esp, 8
cmp word [edi], 0
setne byte [esp + 0xb1]
mov ax, word [esi]
cmp ax, 0x23
je 0x476359
cmp ax, 0x3a
jne 0x47645c
add esi, 2
mov dword [ebp + 8], esi
mov eax, esi
mov ecx, 0x4fa610
mov edx, 1
jmp 0x476370
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x476598
dec edx
jns 0x476370
mov dl, 1
mov byte [esp + 0x2f], dl
mov eax, esi
mov ecx, 0x4fa60c
mov dword [esp + 0x98], 1
movzx edi, word [eax]
movsx ebx, byte [ecx]
or edi, 0x20
or ebx, 0x20
add eax, 2
inc ecx
cmp ebx, edi
jne 0x47659f
dec dword [esp + 0x98]
jns 0x4763a3
mov cl, 1
mov al, cl
or al, dl
neg al
sbb al, al
inc al
test dl, dl
mov byte [esp + 0x6e], cl
mov byte [esp + 0xa5], al
jne 0x4763f3
cmp word [esi], 0x2b
jne 0x4763f3
add esi, 2
mov byte [esp + 0x8f], 1
mov dword [ebp + 8], esi
test cl, cl
jne 0x476423
mov ax, word [esi]
cmp ax, 0x40
je 0x47640c
cmp ax, 0x2d
je 0x47640c
cmp ax, 0x3d
jne 0x476423
mov ecx, dword [esp + 0xa8]
or ecx, 2
add esi, 2
mov dword [esp + 0xa8], ecx
mov dword [ebp + 8], esi
mov si, word [esi]
cmp si, 0x30
jb 0x47645c
cmp si, 0x39
ja 0x47645c
lea edx, [esp + 0x30]
push edx
lea eax, [ebp + 8]
push eax
call fcn.0044ce90
add esp, 8
test eax, eax
jle 0x47645c
mov eax, dword [esp + 0x30]
test eax, eax
mov byte [esp + 0x87], 1
jne 0x47645c
mov byte [esp + 0x2f], 1
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc0]
xor ebx, ebx
lea esi, [esp + 0x2a8]
mov word [esp + 0x2a8], bx
cmp word [eax], bx
mov dword [esp + 0x104], edi
mov dword [esp + 0x12c], esi
je 0x476494
mov dword [esp + 0x12c], eax
mov esi, eax
mov ecx, dword [esp + 0xc0]
push ecx
lea edx, [esp + 0x2ac]
push str..PhysicalDrive_d
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x11
push esi
push str..PhysicalDrive
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4764ed
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0xe8]
add esi, 0x22
push ecx
mov dword [esp + 0xec], esi
call fcn.0044ce90
mov edi, dword [esp + 0x10c]
add esp, 8
mov al, byte [esp + 0x67]
test al, al
jne 0x476501
mov al, byte [esp + 0x36]
test al, al
je 0x4765a6
cmp dword [esp + 0xc0], ebx
jge 0x4765a6
cmp edi, ebx
jge 0x4765a6
push 0x51d604
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x10]
mov eax, dword [0x51d3c8]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add edx, 0xfffffff8
push edx
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x47654e
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x476564
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x476579
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4776ba
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
jmp 0x4776ba
xor dl, dl
jmp 0x47638d
xor cl, cl
jmp 0x4763c6
xor esi, esi
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x30]
or eax, 0xffffffff
cmp ecx, ebx
mov dword [esp + 0xe4], eax
mov dword [esp + 0x7c], ebx
jg 0x4765e3
mov dl, byte [esp + 0x6d]
test dl, dl
jg 0x4765e3
cmp dword [esp + 0x94], ebx
jne 0x4765e3
cmp dword [esp + 0xec], ebx
mov dword [esp + 0x98], ebx
je 0x4765ee
mov dword [esp + 0x98], 1
mov byte [esp + 0x58], 0
mov dword [esp + 0x54], eax
mov al, byte [esp + 0x6f]
test al, al
mov byte [esp + 0x66c], 8
mov dword [esp + 0x18c], 0x80070057
je 0x47663d
cmp edi, ebx
jl 0x47663d
mov cl, byte [esp + 0x6f]
xor eax, eax
test cl, cl
setg al
push 0xffffffffffffffff
push 0xffffffffffffffff
dec eax
cdq
push edx
push eax
push edi
call fcn.00417bd9
mov ecx, dword [esp + 0x44]
add esp, 0x14
mov dword [esp + 0x18c], ebx
mov eax, dword [esp + 0xc4]
cmp eax, ebx
jle 0x47677b
mov dl, byte [esp + 0x43]
test dl, dl
jne 0x47677b
cmp dword [esp + 0xc0], ebx
jge 0x47666e
mov edx, dword [esp + 0x10]
cmp word [edx], bx
je 0x476516
cmp eax, ecx
je 0x476516
cmp ecx, 1
jl 0x476516
cmp ecx, 4
jg 0x476516
cmp byte [esp + 0x53], 2
jl 0x476516
mov eax, dword [str.21:INDATA]
mov ecx, dword [0x4fa674]
mov edx, dword [0x4fa678]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 0x390], eax
mov eax, dword [0x4fa67c]
mov dword [esp + 0x394], ecx
mov ecx, dword [0x4fa680]
mov dword [esp + 0x398], edx
mov edx, dword [0x4fa684]
mov dword [esp + 0x39c], eax
mov dword [esp + 0x3a0], ecx
xor eax, eax
mov dword [esp + 0x3a4], edx
mov ecx, 0xae
lea edi, [esp + 0x3a8]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xc0]
movsx eax, di
push eax
lea ecx, [esp + 0x23c]
push 0x4f1f24
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp word [ecx], bx
lea eax, [esp + 0x238]
je 0x476724
mov eax, ecx
movsx edx, byte [esp + 0x2e]
mov ecx, dword [esp + 0xc4]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
lea eax, [esp + 0x3b6]
push str.__SwapPhyID___.300s___d__d__d
push eax
call esi
add esp, 0x18
lea ecx, [esp + 0x390]
push ecx
mov ecx, dword [esp + 0x188]
call fcn.00433888
mov dword [esp + 0x7c], eax
mov al, byte [esp + 0x36]
test al, al
je 0x479f9a
cmp edi, ebx
jge 0x478fd6
jmp 0x479f9a
cmp byte [esp + 0x67], 0x10
jne 0x47678d
test byte [esp + 0x36], 0x20
jne 0x478fb5
mov al, byte [esp + 0x6f]
test al, al
je 0x476893
cmp dword [esp + 0x98], ebx
jne 0x476893
mov al, byte [esp + 0x2e]
test al, al
jne 0x478fbd
mov al, byte [esp + 0x36]
test al, al
jne 0x478fc2
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x4767e3
mov ecx, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
call fcn.00417bd9
add esp, 0x14
cmp esi, ebx
je 0x4767f3
cmp esi, 0xffffffff
je 0x4767f3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x476802
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x47681f
mov edx, eax
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x476835
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x47684b
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x476860
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x47a16d
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
xor eax, eax
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x601
call fcn.00449130
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x28], edi
je 0x4768ad
mov byte [edi], 0
lea eax, [edi + 0x200]
and eax, 0xfffffe00
mov dword [esp + 0xb8], eax
add eax, 0x200
mov dword [esp + 0x60], eax
cmp dword [esp + 0x94], ebx
mov byte [esp + 0x66c], 9
jne 0x479026
mov esi, dword [esp + 0xec]
cmp esi, ebx
jne 0x4795fc
mov al, byte [esp + 0x6d]
cmp al, 1
je 0x479c40
cmp al, 2
je 0x479c86
cmp al, 3
je 0x479df3
mov al, byte [esp + 0x6e]
test al, al
je 0x476936
mov dword [esp + 0x90], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], 5
mov al, byte [esp + 0x2f]
test al, al
mov edi, dword [esp + 0x38]
je 0x47694a
mov dword [esp + 0x30], 5
mov al, byte [esp + 0x5f]
test al, al
je 0x476972
mov dword [esp + 0x90], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov edi, ebx
mov al, byte [esp + 0xb1]
test al, al
je 0x47698a
cmp dword [esp + 0x104], ebx
jl 0x477661
mov al, byte [esp + 0xa5]
test al, al
je 0x47699f
cmp dword [esp + 0x30], ebx
jl 0x477661
mov ecx, dword [esp + 0x30]
or eax, 0xffffffff
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], eax
mov al, byte [esp + 0x43]
dec ecx
test al, al
mov dword [esp + 0x30], ecx
mov byte [esp + 0xeb], 0
mov byte [esp + 0xe3], 0
mov dword [esp + 0x118], ebx
mov byte [esp + 0xb0], 0
mov byte [esp + 0xb2], 0
mov dword [esp + 0xac], ebx
jne 0x476a21
cmp dword [esp + 0xd0], ebx
jne 0x476a21
mov esi, dword [esp + 0x3c]
mov edx, edi
or edx, esi
jne 0x476a25
mov eax, dword [esp + 0x48]
or eax, dword [esp + 0x4c]
jne 0x476a25
mov byte [esp + 0x5f], 1
jmp 0x476a25
mov esi, dword [esp + 0x3c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [esp + 0xa7]
test al, al
je 0x476a76
cmp esi, ebx
jl 0x476a76
jg 0x476a41
cmp edi, ebx
jb 0x476a76
cmp dword [esp + 0x4c], ebx
jl 0x476a76
jg 0x476a50
cmp dword [esp + 0x48], 0x11
jb 0x476a76
push ebx
push 0x2200
push ebx
push 0x200
push esi
push edi
call fcn.004b4970
mov ecx, dword [esp + 0x10c]
push edx
push eax
push ecx
lea ecx, [esp + 0x68]
call fcn.004474a0
mov edx, dword [esp + 0x12c]
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push edx
lea ecx, [esp + 0x28]
call fcn.00417e55
mov esi, dword [esp + 0xc]
cmp esi, ebx
je 0x479e89
mov al, byte [esp + 0xa7]
test al, al
je 0x476ae8
cmp dword [esp + 0x3c], ebx
jl 0x476ae8
jg 0x476aba
cmp edi, ebx
jb 0x476ae8
cmp dword [esp + 0x4c], ebx
jl 0x476ae8
jg 0x476ac9
cmp dword [esp + 0x48], 0x11
jb 0x476ae8
mov eax, dword [esp + 0x3c]
push eax
push edi
push esi
call fcn.0043dfa0
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.0044fb20
mov dword [esp + 0x18c], ebx
push 1
push ebx
push esi
call fcn.0044f4b0
mov dword [esp + 0xf0], eax
mov al, byte [esp + 0x73]
add esp, 0xc
cmp al, 0x10
jne 0x476b19
lea ecx, [esp + 0x28]
mov byte [esp + 0x66c], 8
call fcn.00443880
jmp 0x478fb1
cmp byte [esp + 0x67], 1
je 0x479e91
mov edx, dword [esp + 0xd0]
xor edi, edi
xor esi, esi
cmp edx, 0xff
jg 0x479f0e
mov al, byte [esp + 0x2f]
test al, al
mov ecx, dword [esp + 0x30]
jne 0x476b9d
cmp ecx, ebx
jge 0x476b9d
cmp dword [esp + 0x3c], ebx
jg 0x479f0e
jl 0x476b61
cmp dword [esp + 0x38], ebx
jae 0x479f0e
cmp dword [esp + 0x4c], ebx
jg 0x479f0e
jl 0x476b77
cmp dword [esp + 0x48], ebx
jae 0x479f0e
cmp edx, ebx
jge 0x479f0e
or eax, 0xffffffff
mov dword [esp + 0xd0], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov edx, eax
jmp 0x476ba0
or eax, 0xffffffff
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov al, byte [esp + 0x2f]
test al, al
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x44], ecx
jne 0x476bf3
cmp byte [esp + 0x6e], al
jne 0x476bf3
cmp ecx, 4
jl 0x4773ad
mov cl, byte [esp + 0x43]
test cl, cl
jne 0x4773ad
mov cl, byte [esp + 0x37]
test cl, cl
jne 0x4773ad
test al, al
je 0x476c17
mov dword [esp + 0x30], 4
cmp edx, 5
je 0x477661
cmp edx, 0xf
je 0x477661
push 0x100000
lea ecx, [esp + 0xa0]
mov dword [esp + 0x7c], ebx
call fcn.004492b0
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x78]
push ecx
push edx
push eax
call fcn.00447240
mov ecx, dword [esp + 0x84]
mov esi, dword [esp + 0x3c]
mov edi, eax
mov al, byte [esp + 0x3b]
add esp, 0xc
test al, al
mov dword [esp + 0x88], edi
jne 0x476c7d
cmp ecx, esi
jge 0x476c7d
cmp esi, 4
jge 0x476cf3
mov al, byte [esp + 0x2f]
test al, al
jne 0x476cb7
mov dl, byte [esp + 0x6e]
test dl, dl
jne 0x476cb7
mov byte [esp + 0x42], al
lea eax, [esi + 1]
call fcn.00447210
cmp eax, ebx
jle 0x476cf3
cmp eax, ecx
jl 0x476ca6
cmp esi, 4
jg 0x476cf3
cmp ecx, 4
jle 0x476cff
lea eax, [ecx - 4]
and eax, 0xfffffffc
mov dword [esp + 0x70], eax
jmp 0x476d03
mov dl, byte [esp + 0x6e]
test dl, dl
mov byte [esp + 0x42], 1
jne 0x476cee
test al, al
je 0x476ca6
cmp dword [esp + 0xd0], ebx
jl 0x476cf3
xor edx, edx
cmp word [esp + 0x90], bx
setle dl
dec edx
and edx, 0x80
mov dword [esp + 0x90], edx
jmp 0x476ca6
cmp ecx, 4
jg 0x476cab
lea ecx, [esp + 0x9c]
jmp 0x47765c
mov dword [esp + 0x70], ebx
mov dl, byte [esp + 0x42]
or ecx, 0xffffffff
test dl, dl
mov dword [esp + 0x68], ecx
mov dword [esp + 0x44], ecx
jne 0x476d2c
cmp esi, 4
jl 0x476d28
lea eax, [esi*4 - 0x10]
mov dword [esp + 0x70], eax
jmp 0x476d2c
mov dword [esp + 0x70], ebx
mov al, byte [edi + 0x50]
cmp al, 5
mov dword [esp + 0x80], ecx
je 0x476d3e
cmp al, 0xf
jne 0x476d47
xor ecx, ecx
mov dword [esp + 0x80], ecx
mov al, byte [edi + 0xe0]
cmp al, 5
je 0x476d55
cmp al, 0xf
jne 0x476d61
mov ecx, 1
mov dword [esp + 0x80], ecx
mov al, byte [edi + 0x170]
cmp al, 5
je 0x476d6f
cmp al, 0xf
jne 0x476d7b
mov ecx, 2
mov dword [esp + 0x80], ecx
mov al, byte [edi + 0x200]
cmp al, 5
je 0x476d89
cmp al, 0xf
jne 0x476d95
mov ecx, 3
mov dword [esp + 0x80], ecx
test dl, dl
je 0x476da1
cmp ecx, ebx
jl 0x476cf3
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x88]
lea ecx, [eax + eax*8]
shl ecx, 4
mov eax, dword [ecx + edx + 0x3c]
lea edi, [ecx + edx + 0x30]
mov ecx, dword [edi + 8]
push 0
push 0x200
push eax
push ecx
call fcn.004b48c0
push 0
mov dword [esp + 0x280], edx
mov dword [esp + 0x1f0], edx
mov edx, dword [edi + 0x14]
push 0x200
mov esi, eax
mov eax, dword [edi + 0x10]
push edx
push eax
mov dword [esp + 0x1f8], esi
call fcn.004b48c0
mov ebx, eax
mov eax, dword [esp + 0x70]
lea ecx, [eax + eax*8]
mov al, byte [esp + 0x6e]
mov dword [esp + 0x26c], edx
mov edx, dword [esp + 0x88]
shl ecx, 4
test al, al
lea edi, [ecx + edx + 0x30]
je 0x476f03
mov eax, dword [esp + 0x78]
xor edi, edi
cmp eax, 8
jne 0x476e39
mov edx, dword [esp + 0x27c]
mov eax, esi
jmp 0x476e9b
mov ecx, dword [esp + 0x88]
add eax, 0xfffffff8
and eax, 0xfffffffc
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + ecx + 0x30]
lea eax, [esi + 0x20]
mov cl, byte [eax]
cmp cl, 5
je 0x476e76
cmp cl, 0xf
je 0x476e76
inc edi
add eax, 0x90
cmp edi, 4
jl 0x476e53
lea ecx, [esp + 0x9c]
jmp 0x47765c
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 0x200
push edx
push eax
call fcn.004b48c0
mov ecx, dword [esi + 0x24]
xor esi, esi
sub eax, ecx
sbb edx, esi
test edi, edi
jl 0x476cf3
xor ecx, ecx
mov dword [esp + 0x23c], ecx
mov dword [esp + 0x240], ecx
push edi
mov dword [esp + 0x248], ecx
lea ecx, [esp + 0x23c]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
push edx
mov dword [esp + 0x24c], 0
call fcn.0044f9b0
mov al, byte [esp + 0x42]
add esp, 0x14
test al, al
je 0x476eeb
mov esi, dword [esp + 0xc]
mov byte [esp + 0x2e], 0
call fcn.00447420
mov al, byte [esp + 0x36]
test al, al
lea ecx, [esp + 0x9c]
je 0x47a10f
jmp 0x478f99
cmp dword [esp + 0x78], 4
jg 0x476f13
mov ecx, dword [esp + 0x80]
jmp 0x476f7c
mov al, byte [edi + 0x20]
cmp al, 5
je 0x476f1e
cmp al, 0xf
jne 0x476f26
mov dword [esp + 0x68], 0
mov al, byte [edi + 0xb0]
cmp al, 5
je 0x476f34
cmp al, 0xf
jne 0x476f3c
mov dword [esp + 0x68], 1
mov al, byte [edi + 0x140]
cmp al, 5
je 0x476f4a
cmp al, 0xf
jne 0x476f55
mov ecx, 2
mov dword [esp + 0x68], ecx
jmp 0x476f59
mov ecx, dword [esp + 0x68]
mov al, byte [edi + 0x1d0]
cmp al, 5
je 0x476f67
cmp al, 0xf
jne 0x476f70
mov ecx, 3
mov dword [esp + 0x68], ecx
mov al, byte [esp + 0x42]
test al, al
jne 0x476f80
add ecx, dword [esp + 0x70]
mov dword [esp + 0x68], ecx
xor edx, edx
cmp ecx, edx
jge 0x476f92
mov al, byte [esp + 0x2f]
test al, al
je 0x476cf3
mov al, byte [esp + 0x42]
test al, al
je 0x476fa0
mov dword [esp + 0x44], edx
jmp 0x47700c
mov al, byte [edi + 0x260]
cmp al, 5
je 0x476fb2
cmp al, 0xf
je 0x476fb2
mov dword [esp + 0x44], edx
mov al, byte [edi + 0x2f0]
test al, al
je 0x476fcc
cmp al, 5
je 0x476fcc
cmp al, 0xf
je 0x476fcc
mov dword [esp + 0x44], 1
mov al, byte [edi + 0x380]
test al, al
je 0x476fe6
cmp al, 5
je 0x476fe6
cmp al, 0xf
je 0x476fe6
mov dword [esp + 0x44], 2
mov al, byte [edi + 0x410]
test al, al
je 0x477002
cmp al, 5
je 0x477002
cmp al, 0xf
je 0x477002
mov dword [esp + 0x44], 3
jmp 0x47700c
cmp dword [esp + 0x44], edx
jl 0x476cf3
mov al, byte [esp + 0x2f]
test al, al
je 0x477290
mov eax, dword [esp + 0x70]
cmp eax, edx
jg 0x477027
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x88]
lea eax, [eax + eax*8]
shl eax, 4
lea esi, [eax + ecx + 0x30]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0
push 0x200
push ecx
push eax
mov dword [esp + 0x11c], ecx
call fcn.004b48c0
cmp dword [esp + 0x78], 4
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], edx
jle 0x477139
mov ecx, dword [esp + 0x68]
test ecx, ecx
jge 0x477139
mov al, byte [edi + 0x20]
test al, al
je 0x479f85
mov eax, dword [esp + 0x78]
cmp eax, 8
jle 0x477095
add eax, 0xfffffff8
and eax, 0xfffffffc
inc eax
jmp 0x47709c
mov eax, dword [esp + 0x80]
lea edx, [eax + eax*8]
mov eax, dword [esp + 0x88]
push 0
shl edx, 4
mov ecx, dword [edx + eax + 0x3c]
mov edx, dword [edx + eax + 0x38]
push 0x200
push ecx
push edx
call fcn.004b48c0
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x198], eax
mov eax, dword [edi + 0x10]
push 0
mov dword [esp + 0x1a0], edx
mov edx, dword [edi + 0xc]
add eax, esi
push 0x200
adc ecx, edx
push ecx
push eax
call fcn.004b48c0
mov edi, dword [esp + 0x1ec]
mov ecx, eax
mov esi, edx
mov edx, dword [esp + 0x1e8]
sub eax, edx
mov dword [esp + 0x140], eax
mov eax, esi
sbb eax, edi
mov edi, dword [esp + 0x26c]
sub ebx, ecx
mov dword [esp + 0x144], eax
mov eax, dword [esp + 0x1ec]
sbb edi, esi
add ebx, edx
adc edi, eax
mov eax, ebx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], edi
jmp 0x477196
mov ecx, dword [esp + 0x70]
test ecx, ecx
jle 0x477163
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 8]
mov ecx, dword [esp + 0x10c]
mov eax, dword [esi + 0x14]
push 0
add edx, edi
push 0x200
adc eax, ecx
push eax
push edx
call fcn.004b48c0
mov edi, dword [esp + 0x26c]
mov ecx, eax
mov eax, dword [esp + 0x1ec]
mov esi, edx
mov edx, dword [esp + 0x1e8]
sub ebx, ecx
sbb edi, esi
add ebx, edx
adc edi, eax
xor edx, edx
mov eax, ebx
mov dword [esp + 0x178], edx
mov dword [esp + 0x17c], edx
test edi, edi
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], esi
jl 0x476cf3
jg 0x4771b6
test eax, eax
jbe 0x476cf3
mov dl, byte [esp + 0xa6]
test dl, dl
je 0x4771d5
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add ebx, ecx
adc edx, esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x3c]
mov edx, ecx
add edx, 1
mov dword [esp + 0x200], edx
mov edx, esi
adc edx, 0
cmp ebx, edx
mov dword [esp + 0x204], edx
jg 0x47721a
jl 0x47720b
mov edx, dword [esp + 0x38]
cmp edx, dword [esp + 0x200]
ja 0x47721a
mov edx, dword [esp + 0x204]
mov ebx, dword [esp + 0x200]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
sub eax, edx
mov edx, dword [esp + 0x4c]
sbb edi, ebx
add eax, ecx
adc edi, esi
cmp edx, edi
jl 0x477242
jg 0x47723a
cmp dword [esp + 0x48], eax
jbe 0x477242
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x4c]
test eax, eax
jl 0x476cf3
jg 0x47725c
mov eax, dword [esp + 0x48]
test eax, eax
jb 0x476cf3
mov eax, dword [esp + 0x70]
test eax, eax
mov eax, dword [esp + 0x78]
jle 0x47727d
dec eax
and eax, 0xfffffffc
call fcn.00447220
inc eax
mov dword [esp + 0x30], eax
mov edi, ecx
jmp 0x4773a1
and eax, 0xfffffffc
call fcn.00447220
mov dword [esp + 0x30], eax
mov edi, ecx
jmp 0x4773a1
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x88]
lea eax, [eax + eax*8]
shl eax, 4
lea edi, [eax + ecx + 0x30]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
push 0
mov dword [esp + 0x22c], eax
add eax, 0x200
mov dword [esp + 0x230], ecx
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.004b48c0
mov esi, edx
mov edx, dword [edi + 0x10]
mov ebx, eax
mov eax, dword [edi + 0x14]
push 0
sub edx, 0x200
push 0x200
sbb eax, 0
push eax
push edx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], esi
call fcn.004b48c0
mov cl, byte [esp + 0xa6]
test cl, cl
je 0x47731d
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
add edi, ebx
adc ecx, esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jl 0x477343
jg 0x47732f
mov edi, dword [esp + 0x38]
test edi, edi
jbe 0x477343
cmp ecx, esi
jg 0x477343
jl 0x47733b
cmp dword [esp + 0x38], ebx
ja 0x477343
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jl 0x477381
jg 0x477355
mov esi, dword [esp + 0x48]
test esi, esi
jbe 0x477381
cmp ecx, edx
jl 0x47736b
jg 0x477361
cmp dword [esp + 0x48], eax
jbe 0x47736b
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
mov ecx, edx
test ecx, ecx
jl 0x476cf3
jg 0x477381
mov eax, dword [esp + 0x48]
test eax, eax
jb 0x476cf3
mov ecx, dword [esp + 0x22c]
mov edx, dword [esp + 0x228]
push 0
push 0x200
push ecx
push edx
call fcn.004b48c0
mov edi, eax
mov esi, edx
lea ecx, [esp + 0x9c]
call fcn.00443880
mov ecx, dword [esp + 0x30]
push 0
push 0x200
push esi
cmp ecx, 4
push edi
setge byte [esp + 0xc3]
call fcn.004b4970
mov edi, dword [esp + 0x60]
mov ebx, eax
xor eax, eax
push eax
mov esi, edx
mov ecx, 0x80
push esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x218], ebx
mov dword [esp + 0x21c], esi
call fcn.00444930
add esp, 0x10
cmp eax, ebx
jne 0x47845e
cmp edx, esi
jne 0x47845e
mov esi, dword [esp + 0x60]
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0xc0]
push ecx
push 0x200
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov edi, dword [esp + 0xb8]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
je 0x47845e
mov al, byte [esp + 0x37]
test al, al
je 0x477529
mov al, byte [esp + 0x43]
test al, al
jne 0x477529
mov esi, dword [esp + 0x60]
push esi
call fcn.00447470
xor eax, eax
mov ecx, 0x10
lea edi, [esi + 0x1be]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xbc]
push 0x200
push esi
push eax
mov word [esi + 0x1fe], 0xaa55
call fcn.004438e0
add esp, 0x10
test eax, eax
je 0x4774d5
mov ecx, dword [esp + 0x20c]
mov edi, dword [esp + 0xc]
push 0
push ecx
push ebx
push edi
call fcn.00444930
add esp, 0x10
push 0
lea edx, [esp + 0xc0]
push edx
push 0x200
push esi
push edi
mov dword [esp + 0xd0], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x7c], eax
mov al, byte [esp + 0x2e]
test al, al
je 0x4774f6
mov eax, dword [esp + 0xc0]
test eax, eax
jl 0x4774f6
mov esi, dword [esp + 0xc]
mov byte [esp + 0x2e], 0
call fcn.00447420
mov al, byte [esp + 0x36]
test al, al
je 0x479f91
mov eax, dword [esp + 0xc0]
test eax, eax
jl 0x479f91
lea ecx, [esp + 0x28]
mov byte [esp + 0x66c], 8
call fcn.00443880
xor ebx, ebx
jmp 0x478fd6
mov al, byte [esp + 0x53]
test al, al
jne 0x477547
mov al, byte [esp + 0x87]
test al, al
je 0x47755e
cmp dword [esp + 0x30], 1
jle 0x477661
mov al, byte [esp + 0x87]
test al, al
je 0x47755e
mov eax, dword [esp + 0x30]
test eax, eax
jl 0x477661
mov esi, dword [esp + 0xc]
push esi
call fcn.00446dd0
add esp, 4
mov edi, eax
push 0x100000
lea ecx, [esp + 0x78]
mov dword [esp + 0x6c], edi
call fcn.004492b0
mov ecx, dword [esp + 0x104]
xor eax, eax
cmp ecx, eax
mov byte [esp + 0x66c], 0x11
mov dword [esp + 0xbc], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], eax
jl 0x4775cb
mov esi, dword [esp + 0x74]
mov ebx, dword [esp + 0xc]
call fcn.00446f60
push 0
push edi
push edx
push eax
call fcn.004b48c0
mov dword [esp + 0x1a4], edx
mov esi, ebx
jmp 0x47761c
mov edx, dword [esp + 0x12c]
lea ecx, [esp + 0x284]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x477623
test byte [esp + 0x284], 0x10
jne 0x477623
mov eax, dword [esp + 0x2a0]
mov edx, dword [esp + 0x2a4]
and eax, 0xfffffe00
xor ecx, ecx
shld ecx, eax, 0x17
shl eax, 0x17
shr edx, 9
xor ebx, ebx
or eax, edx
or ecx, ebx
mov dword [esp + 0x1a4], ecx
mov dword [esp + 0x1a0], eax
mov ecx, dword [esp + 0x74]
lea eax, [esp + 0x11c]
push eax
push ecx
push esi
call fcn.00447240
mov edx, dword [esp + 0x1c]
mov cx, word [edx]
add esp, 0xc
test cx, cx
mov dword [esp + 0x11c], eax
jne 0x4776d6
test eax, eax
jne 0x4776da
lea ecx, [esp + 0x74]
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov eax, 0x80070057
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4776de
mov eax, dword [eax]
jmp 0x4776e0
xor eax, eax
cmp eax, 1
sete al
test al, al
mov byte [esp + 0x35], al
je 0x4776fd
mov al, byte [esp + 0xf1]
test al, al
jne 0x4776fd
mov al, 1
jmp 0x4776ff
xor al, al
mov dl, byte [esp + 0xf3]
test dl, dl
mov byte [esp + 0x6c], al
jne 0x477730
mov dl, byte [esp + 0x37]
test dl, dl
jne 0x477730
test al, al
mov al, byte [esp + 0x43]
je 0x477728
test al, al
je 0x477658
jmp 0x477730
test al, al
jne 0x477658
test cx, cx
mov eax, dword [esp + 0x158]
mov edx, dword [esp + 0x160]
mov ebx, dword [esp + 0x168]
mov dword [esp + 0x80], eax
mov dword [esp + 0x78], edx
mov dword [esp + 0x88], ebx
jne 0x47784f
xor eax, eax
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], eax
push eax
lea ecx, [esp + 0xc0]
push ecx
push 0x18
lea edx, [esp + 0x254]
push edx
push eax
push eax
push 0x70000
push esi
mov dword [esp + 0x268], 0
mov dword [esp + 0x27c], eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x15c]
test eax, eax
jg 0x4777e6
jl 0x4777c9
mov eax, dword [esp + 0x158]
test eax, eax
ja 0x4777e6
mov eax, dword [esp + 0x254]
mov dword [esp + 0x80], eax
cdq
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], edx
mov eax, dword [esp + 0x164]
test eax, eax
jg 0x477818
jl 0x4777fe
mov eax, dword [esp + 0x160]
test eax, eax
ja 0x477818
mov eax, dword [esp + 0x258]
mov dword [esp + 0x78], eax
cdq
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], edx
mov eax, dword [esp + 0x16c]
test eax, eax
jg 0x47784f
jl 0x477830
mov eax, dword [esp + 0x168]
test eax, eax
ja 0x47784f
mov eax, dword [esp + 0x25c]
mov ebx, eax
cdq
mov dword [esp + 0x88], ebx
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], edx
mov eax, dword [esp + 0x15c]
xor ecx, ecx
cmp eax, ecx
jg 0x477881
jl 0x477867
cmp dword [esp + 0x158], ecx
ja 0x477881
mov eax, 0xff
mov dword [esp + 0x80], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], ecx
cmp dword [esp + 0x164], ecx
jg 0x4778ac
jl 0x477895
cmp dword [esp + 0x160], ecx
ja 0x4778ac
mov eax, 0x3f
mov dword [esp + 0x78], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], ecx
cmp dword [esp + 0x16c], ecx
jg 0x4778da
jl 0x4778c0
cmp dword [esp + 0x168], ecx
ja 0x4778da
mov ebx, 0x200
mov dword [esp + 0x88], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ecx
mov eax, ebx
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x74]
lea ebx, [eax + edi]
lea eax, [edi + ebx]
mov dword [esp + 0x70], eax
add eax, 0x10000
mov dword [esp + 0xb4], eax
mov al, byte [esp + 0x6c]
test al, al
jne 0x4784d3
mov al, byte [esp + 0x43]
test al, al
jne 0x4784d3
mov al, byte [esp + 0x5f]
test al, al
mov byte [esp + 0x35], 0
jne 0x477f42
mov esi, dword [esp + 0x3c]
test esi, esi
mov ebx, dword [esp + 0x38]
jg 0x47795e
jl 0x477944
test ebx, ebx
jae 0x47795e
mov eax, dword [esp + 0x4c]
test eax, eax
jl 0x477f42
jg 0x47795e
mov eax, dword [esp + 0x48]
test eax, eax
jb 0x477f42
mov eax, dword [esp + 0x30]
test eax, eax
jl 0x477f42
push 0x100000
lea ecx, [esp + 0xf8]
call fcn.004492b0
mov eax, dword [esp + 0x88]
imul eax, dword [esp + 0x78]
cdq
and edx, 0x1ff
add eax, edx
mov edi, eax
mov eax, dword [esp + 0x80]
sar edi, 9
imul eax, edi
cdq
mov dword [esp + 0x1b0], eax
mov eax, dword [esp + 0x88]
test eax, eax
mov dword [esp + 0x1b4], edx
jle 0x47a01a
mov ecx, dword [esp + 0x10]
cmp word [ecx], 0
jne 0x477a17
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0xb4]
push edx
push eax
push ecx
mov dword [esp + 0xc0], 0
call fcn.00447240
add esp, 0xc
test eax, eax
je 0x47a005
cmp dword [esp + 0x30], 4
jl 0x477a17
mov al, byte [esp + 0x2f]
test al, al
jne 0x477a17
mov edx, dword [esp + 0x30]
cmp edx, dword [esp + 0xb4]
jge 0x47a01a
xor eax, eax
xor edx, edx
test esi, esi
jl 0x477ae5
jg 0x477a2d
test ebx, ebx
jbe 0x477ae5
mov ecx, dword [esp + 0xd8]
and ecx, dword [esp + 0xdc]
cmp ecx, 0xffffffff
jne 0x477a74
cmp esi, dword [esp + 0x1b4]
jl 0x477a6f
jg 0x477a54
cmp ebx, dword [esp + 0x1b0]
jb 0x477a6f
mov al, byte [esp + 0xb3]
test al, al
jne 0x477a6f
mov edx, dword [esp + 0x1b4]
mov eax, dword [esp + 0x1b0]
jmp 0x477acd
mov eax, edi
cdq
jmp 0x477acd
mov cl, byte [esp + 0xa4]
test cl, cl
jne 0x477ae5
mov eax, dword [esp + 0x88]
mov edi, dword [esp + 0xd8]
cdq
mov ecx, eax
add ecx, edi
mov edi, edx
adc edi, dword [esp + 0xdc]
push edx
sub ecx, 1
push eax
sbb edi, 0
push edi
push ecx
call fcn.004b48c0
mov ecx, eax
mov eax, dword [esp + 0x134]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.004b4970
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edx
push edx
push eax
push esi
push ebx
call fcn.00447340
add esp, 0x10
add ebx, eax
adc esi, edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jl 0x477b27
jg 0x477af7
mov edi, dword [esp + 0x48]
test edi, edi
jbe 0x477b27
cmp byte [esp + 0xf2], 0
jne 0x477b27
mov edi, dword [esp + 0x48]
sub edi, eax
sbb ecx, edx
test ecx, ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ecx
jg 0x477b27
jl 0x477b1d
mov eax, edi
test eax, eax
jae 0x477b27
xor eax, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
test esi, esi
jl 0x477b39
jg 0x477b31
test ebx, ebx
jbe 0x477b39
mov edi, dword [esp + 0x38]
mov ebx, esi
jmp 0x477b3d
xor edi, edi
xor ebx, ebx
mov eax, dword [esp + 0x4c]
test eax, eax
jl 0x477c26
jg 0x477b57
mov eax, dword [esp + 0x48]
test eax, eax
jbe 0x477c26
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
and edx, ecx
cmp edx, 0xffffffff
jne 0x477b98
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1b0]
add edi, eax
mov eax, dword [esp + 0x1b4]
push eax
push ecx
adc ebx, edx
push ebx
push edi
call fcn.004b65e0
sub dword [esp + 0x48], eax
jmp 0x477c22
mov al, byte [esp + 0xa4]
test al, al
jne 0x477c26
mov eax, dword [esp + 0x88]
cdq
mov esi, eax
add eax, dword [esp + 0xc8]
mov dword [esp + 0x264], edx
adc edx, ecx
mov ecx, dword [esp + 0x264]
push ecx
sub eax, 1
push esi
sbb edx, 0
push edx
push eax
call fcn.004b48c0
mov ecx, dword [esp + 0x264]
push ecx
push esi
push edx
push eax
call fcn.004b4970
push 0
push 0x200
push edx
push eax
call fcn.004b48c0
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
push edx
add edi, esi
push eax
adc ebx, ecx
push ebx
push edi
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edx
call fcn.004b65e0
sub esi, eax
mov dword [esp + 0x48], esi
mov esi, dword [esp + 0x3c]
sbb dword [esp + 0x4c], edx
mov eax, dword [esp + 0x17c]
test eax, eax
mov byte [esp + 0x35], 0
mov byte [esp + 0x42], 0
mov byte [esp + 0x6c], 0
jl 0x477dbd
jg 0x477c55
mov eax, dword [esp + 0x178]
test eax, eax
jbe 0x477dbd
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x13c]
mov edx, dword [esp + 0x38]
sub ecx, eax
mov eax, dword [esp + 0x134]
sbb edi, ebx
add ecx, edx
cdq
push edx
push eax
adc edi, esi
push edi
push ecx
call fcn.004b48c0
mov ecx, dword [esp + 0x78]
mov edi, dword [esp + 0x140]
mov dword [esp + 0x17c], edx
xor edx, edx
push 1
mov ebx, eax
mov eax, dword [esp + 0x84]
push eax
mov dword [esp + 0x1e4], edx
mov dword [esp + 0x1e8], edx
push ecx
mov dword [esp + 0x1f0], edx
lea edx, [esp + 0x78]
push edx
mov edx, dword [esp + 0x154]
lea eax, [esp + 0x52]
push eax
lea ecx, [esp + 0x49]
push ecx
push edx
push edi
mov dword [esp + 0x198], ebx
mov dword [esp + 0x1f8], 0
call fcn.00447370
mov al, byte [esp + 0x62]
mov cl, byte [esp + 0x8c]
mov dl, byte [esp + 0x55]
add esp, 0x20
push 1
mov byte [esp + 0x1dd], al
mov eax, dword [esp + 0x84]
push eax
mov byte [esp + 0x1e2], cl
mov ecx, dword [esp + 0x80]
push ecx
mov byte [esp + 0x1e7], dl
lea edx, [esp + 0x78]
push edx
mov edx, dword [esp + 0x154]
lea eax, [esp + 0x52]
push eax
lea ecx, [esp + 0x49]
push ecx
push 0
push 2
push edx
push edi
mov byte [esp + 0x200], 0
call fcn.004b4970
add eax, 0xffffffff
adc edx, 0xffffffff
push edx
push eax
call fcn.00447370
mov al, byte [esp + 0x62]
mov cl, byte [esp + 0x8c]
mov dl, byte [esp + 0x55]
mov byte [esp + 0x1fd], al
mov byte [esp + 0x1fc], 5
mov byte [esp + 0x1fe], cl
mov byte [esp + 0x1ff], dl
mov dword [esp + 0x200], edi
mov dword [esp + 0x204], ebx
push 1
lea eax, [esp + 0x1fc]
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x1bc]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
call fcn.0044f9b0
add esp, 0x34
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
cdq
push edx
mov ebx, eax
push ebx
mov dword [esp + 0x27c], edx
mov edx, dword [esp + 0x140]
push ecx
push edx
call fcn.004b48c0
test esi, esi
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], edx
jl 0x477e29
jg 0x477e01
mov eax, dword [esp + 0x38]
test eax, eax
jb 0x477e29
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x38]
push eax
push ebx
push esi
push ecx
call fcn.004b48c0
mov edi, eax
mov dword [esp + 0x120], edi
mov dword [esp + 0x124], edx
xor eax, eax
jmp 0x477e3b
xor eax, eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov edi, eax
cmp dword [esp + 0x4c], eax
jl 0x477e6a
jg 0x477e49
cmp dword [esp + 0x48], eax
jb 0x477e6a
mov edx, dword [esp + 0x274]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push edx
push ebx
push eax
push ecx
call fcn.004b48c0
mov dword [esp + 0x154], edx
jmp 0x477e71
mov dword [esp + 0x154], eax
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x150], eax
mov eax, dword [esp + 0x30]
xor edx, edx
cmp eax, 4
mov eax, dword [esp + 0x80]
setge dl
lea ecx, [esp + 0xeb]
push edx
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x134]
lea edx, [esp + 0xf3]
push edx
lea eax, [esp + 0x12c]
push eax
push ecx
push edi
call fcn.00447370
add esp, 0x20
test esi, esi
jl 0x477ef0
jg 0x477ec9
mov eax, dword [esp + 0x38]
test eax, eax
jbe 0x477ef0
mov ecx, dword [esp + 0x230]
mov eax, dword [esp + 0x124]
mov edx, dword [esp + 0x234]
sub edi, ecx
sbb eax, edx
mov dword [esp + 0x120], edi
mov dword [esp + 0x124], eax
mov cl, byte [esp + 0xb3]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x150]
mov byte [esp + 0x35], cl
movsx ecx, cl
push ecx
push edx
push ebx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xc2]
push edx
lea ecx, [esp + 0xc0]
push ecx
lea eax, [edi + eax - 1]
push 0
push eax
call fcn.00447370
add esp, 0x20
lea ecx, [esp + 0xf4]
call fcn.00443880
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0xb8]
mov ecx, 0x80
mov esi, eax
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x17c]
shl ebx, 4
test ecx, ecx
jl 0x477fc0
jg 0x477f77
mov ecx, dword [esp + 0x178]
test ecx, ecx
jb 0x477fc0
test edx, edx
jle 0x477f97
mov edi, dword [esp + 0x60]
mov ecx, ebx
mov esi, ecx
shr ecx, 2
add edi, 0x1be
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, 3
sub ecx, edx
mov edx, dword [esp + 0x60]
shl ecx, 4
lea edi, [ebx + edx + 0x1ce]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x60]
mov dl, byte [esp + 0x2f]
test dl, dl
mov cl, byte [ebx + eax + 0x1c2]
jne 0x477fec
cmp byte [esp + 0x53], 2
jge 0x477fe8
cmp cl, 5
je 0x477658
cmp cl, 0xf
je 0x477658
mov eax, dword [esp + 0x60]
test dl, dl
mov esi, dword [ebx + eax + 0x1c6]
mov edi, dword [ebx + eax + 0x1ca]
jne 0x47807c
test cl, cl
je 0x47807c
mov edx, dword [esp + 0xd0]
test edx, edx
je 0x478083
cmp byte [esp + 0x53], 2
jge 0x478083
mov cl, byte [esp + 0xb3]
test cl, cl
jne 0x478083
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jl 0x47804d
jg 0x478031
mov ecx, dword [esp + 0x38]
test ecx, ecx
jb 0x47804d
xor ecx, ecx
cmp dword [esp + 0x120], esi
jne 0x477658
cmp dword [esp + 0x124], ecx
jne 0x477658
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jl 0x478083
jg 0x47805f
mov ecx, dword [esp + 0x48]
test ecx, ecx
jb 0x478083
xor ecx, ecx
cmp dword [esp + 0x150], edi
jne 0x478073
cmp dword [esp + 0x154], ecx
je 0x478083
test edi, edi
je 0x478083
jmp 0x477658
mov edx, dword [esp + 0xd0]
mov cl, byte [esp + 0x5f]
test cl, cl
je 0x4780af
xor ecx, ecx
xor edi, edi
xor esi, esi
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x150], ecx
mov dword [esp + 0x154], ecx
jmp 0x4780b1
xor ecx, ecx
cmp edx, ecx
jl 0x4780bc
mov byte [ebx + eax + 0x1c2], dl
mov ecx, dword [esp + 0x90]
test cx, cx
jl 0x4780cf
mov byte [ebx + eax + 0x1be], cl
mov edx, dword [esp + 0x3c]
test edx, edx
jg 0x478108
jl 0x4780e1
mov edx, dword [esp + 0x38]
test edx, edx
jae 0x478108
mov edx, dword [esp + 0x4c]
test edx, edx
jl 0x4781c9
jg 0x4780fb
mov edi, dword [esp + 0x48]
test edi, edi
jb 0x4781c9
mov eax, dword [esp + 0x150]
lea eax, [esi + eax - 1]
jmp 0x478125
mov edx, dword [esp + 0x4c]
test edx, edx
jg 0x47816d
jl 0x47811a
mov esi, dword [esp + 0x48]
test esi, esi
jae 0x47816d
mov ecx, dword [esp + 0x120]
lea eax, [edi + ecx - 1]
movsx edx, byte [esp + 0x35]
mov ecx, dword [esp + 0x80]
push edx
mov edx, dword [esp + 0x7c]
push ecx
push edx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xc2]
push edx
lea ecx, [esp + 0xc0]
push ecx
push 0
push eax
call fcn.00447370
mov ecx, dword [esp + 0xb0]
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x6c]
add esp, 0x20
mov esi, dword [esp + 0x3c]
test esi, esi
jl 0x4781bb
jg 0x47817f
mov esi, dword [esp + 0x38]
test esi, esi
jb 0x4781bb
mov dl, byte [esp + 0xe3]
mov byte [ebx + eax + 0x1bf], dl
mov dl, byte [esp + 0xeb]
mov byte [ebx + eax + 0x1c0], dl
mov dl, byte [esp + 0x118]
mov byte [ebx + eax + 0x1c1], dl
mov edx, dword [esp + 0x120]
mov dword [ebx + eax + 0x1c6], edx
mov edx, dword [esp + 0x4c]
test edx, edx
jg 0x4781db
jl 0x4781c9
mov esi, dword [esp + 0x48]
test esi, esi
jae 0x4781db
mov esi, dword [esp + 0x3c]
test esi, esi
jl 0x47820d
jg 0x4781db
mov edi, dword [esp + 0x38]
test edi, edi
jb 0x47820d
mov dl, byte [esp + 0xb2]
mov esi, dword [esp + 0x3c]
mov byte [ebx + eax + 0x1c3], dl
mov dl, byte [esp + 0xb0]
mov byte [ebx + eax + 0x1c4], dl
mov dl, byte [esp + 0xac]
mov byte [ebx + eax + 0x1c5], dl
mov edx, dword [esp + 0x4c]
test edx, edx
jl 0x478229
jg 0x47821b
mov edi, dword [esp + 0x48]
test edi, edi
jb 0x478229
mov edi, dword [esp + 0x150]
mov dword [ebx + eax + 0x1ca], edi
mov edi, dword [esp + 0xd0]
test edi, edi
jge 0x478255
test cx, cx
jge 0x478255
test esi, esi
jg 0x478255
jl 0x478247
mov ebx, dword [esp + 0x38]
test ebx, ebx
jae 0x478255
test edx, edx
jl 0x478263
jg 0x478255
mov ebx, dword [esp + 0x48]
test ebx, ebx
jb 0x478263
mov byte [eax + 0x1fe], 0x55
mov byte [eax + 0x1ff], 0xaa
test cx, cx
jge 0x478296
test edi, edi
jge 0x478296
test esi, esi
jg 0x478296
jl 0x47827a
mov ecx, dword [esp + 0x38]
test ecx, ecx
jae 0x478296
test edx, edx
jg 0x478296
jl 0x478288
mov ecx, dword [esp + 0x48]
test ecx, ecx
jae 0x478296
mov byte [eax + 0x1fe], 0x55
mov byte [eax + 0x1ff], 0xaa
mov edi, dword [esp + 0x20c]
mov ebx, dword [esp + 0x208]
mov esi, dword [esp + 0xc]
push 0
push edi
push ebx
push esi
call fcn.00444930
add esp, 0x10
cmp eax, ebx
jne 0x47a011
cmp edx, edi
jne 0x47a011
or ebx, edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x44], 1
jne 0x4782de
push edi
call fcn.00447470
add esp, 4
mov ecx, dword [esp + 0xb8]
mov eax, 0x200
mov edx, edi
call fcn.00449820
test eax, eax
jne 0x478318
push eax
lea eax, [esp + 0xc0]
push eax
push 0x200
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [esp + 0x48], eax
call fcn.00447400
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
jl 0x47842b
jg 0x478334
cmp dword [esp + 0x38], 0x200
jb 0x47842b
mov eax, dword [esp + 0x4c]
test eax, eax
jl 0x47842b
jg 0x478350
cmp dword [esp + 0x48], 0x200
jbe 0x47842b
mov al, byte [esp + 0xd7]
test al, al
je 0x47842b
mov edi, dword [esp + 0x60]
mov edx, dword [esp + 0x38]
xor eax, eax
push eax
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40]
push 0x200
push ecx
push edx
call fcn.004b4970
push 0
mov ebx, edx
mov edi, eax
push ebx
push edi
push esi
call fcn.00444930
add esp, 0x10
cmp eax, edi
jne 0x478423
cmp edx, ebx
jne 0x478423
mov ecx, dword [esp + 0xb8]
push 0
lea eax, [esp + 0xc0]
push eax
push 0x200
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov dword [esp + 0x44], eax
je 0x478423
cmp dword [esp + 0xbc], 0x200
jne 0x478423
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0xb8]
mov eax, 0x200
call fcn.00449820
test eax, eax
jne 0x47842b
push eax
push ebx
push edi
push esi
call fcn.00444930
add esp, 0x10
cmp eax, edi
jne 0x478423
cmp edx, ebx
jne 0x478423
mov eax, dword [esp + 0x60]
push 0
lea edx, [esp + 0xc0]
push edx
push 0x200
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x44], eax
jmp 0x47842b
mov dword [esp + 0x44], 0
mov al, byte [esp + 0x2e]
test al, al
je 0x47843d
mov byte [esp + 0x2e], 0
call fcn.00447420
mov al, byte [esp + 0x36]
test al, al
jne 0x478f95
mov eax, dword [esp + 0x44]
test eax, eax
lea ecx, [esp + 0x74]
jne 0x47a10f
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov eax, 1
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [esp + 0x5f]
test al, al
je 0x4784e3
mov byte [esp + 0x8f], 0
mov al, byte [esp + 0x35]
test al, al
je 0x478503
mov al, byte [esp + 0x37]
test al, al
jne 0x478503
mov ecx, dword [esp + 0x11c]
mov edx, dword [ecx + 0x28]
mov dword [esp + 0x60], edx
jmp 0x47850b
mov dword [esp + 0x60], 0x80
mov cl, byte [esp + 0xe2]
test cl, cl
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xf8], esi
mov dword [esp + 0xfc], eax
je 0x478552
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esi, ecx
adc eax, edx
sub esi, 1
mov ecx, 0
sbb eax, ecx
mov dword [esp + 0xf8], esi
mov dword [esp + 0xfc], eax
jmp 0x478554
xor ecx, ecx
mov dl, byte [esp + 0x37]
test dl, dl
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], ecx
je 0x4785c9
cmp dword [esp + 0x3c], ecx
jg 0x478585
jl 0x478579
cmp dword [esp + 0x38], 1
jae 0x478585
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], ecx
cmp eax, ecx
mov dword [esp + 0x148], esi
mov dword [esp + 0x14c], eax
jg 0x4785bf
jl 0x47859e
cmp esi, 1
jae 0x4785bf
mov eax, dword [esp + 0x1a0]
mov edx, dword [esp + 0x1a4]
sub eax, 1
sbb edx, ecx
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], edx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
jmp 0x4785cb
xor eax, eax
lea edx, [esp + 0x148]
push edx
push ecx
mov ecx, dword [esp + 0x7c]
push eax
mov eax, dword [esp + 0x6c]
push edi
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0044f2b0
mov cl, byte [esp + 0x51]
add esp, 0x1c
test cl, cl
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], edx
jne 0x47861d
or eax, edx
jne 0x47861d
mov dword [esp + 0x170], 1
mov dword [esp + 0x174], 0
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x60]
cmp esi, eax
mov dword [esp + 0x134], 1
jae 0x47865b
cmp dword [esp + 0xc4], eax
jge 0x47865b
mov edx, dword [esp + 0x70]
mov ecx, esi
shl ecx, 7
add ecx, edx
mov eax, 0x10
mov edx, 0x4f7ab8
call fcn.00449820
test eax, eax
je 0x478666
mov dword [esp + 0x134], 0
mov al, byte [esp + 0x37]
test al, al
je 0x47884f
mov eax, dword [esp + 0x60]
cmp esi, eax
jae 0x477658
shl eax, 7
xor edx, edx
div edi
mov esi, dword [esp + 0x70]
test eax, eax
jle 0x4786b6
mov edx, eax
nop
xor eax, eax
mov edi, esi
mov ecx, 0x6c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [esi + 0x1b4]
mov ecx, 0x12
rep stosd dword es:[edi], eax
add esi, dword [esp + 0x68]
dec edx
stosw word es:[edi], ax
jne 0x478690
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
xor eax, eax
mov ecx, 0x17
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [str.EFI_PART]
mov dword [ebx], eax
mov ecx, dword [0x4fa5c4]
mov eax, dword [esp + 0x14c]
mov dword [ebx + 0x18], edx
add edx, 0x21
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x148]
mov dword [ebx + 0x1c], esi
adc esi, 0
mov dword [ebx + 0x20], ecx
add ecx, 0xffffffe0
mov dword [ebx + 0x24], eax
adc eax, 0xffffffff
mov dword [ebx + 0x28], edx
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x34], eax
or edx, dword [ebx + 0x3c]
mov dword [ebx + 8], 0x10000
mov dword [ebx + 0xc], 0x5c
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], ecx
jne 0x478743
mov eax, dword [0x4fa5b0]
mov dword [ebx + 0x38], eax
mov ecx, dword [0x4fa5b4]
mov dword [ebx + 0x3c], ecx
mov edx, dword [0x4fa5b8]
mov dword [ebx + 0x40], edx
mov eax, dword [0x4fa5bc]
mov dword [ebx + 0x44], eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add ecx, 1
mov dword [ebx + 0x48], ecx
mov eax, 0x80
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov eax, dword [esp + 0xb4]
adc edx, 0
mov dword [ebx + 0x4c], edx
mov edi, eax
mov ecx, 0x17
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x20]
mov dword [eax + 0x18], ecx
mov edx, dword [ebx + 0x24]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx + 0x18]
mov dword [eax + 0x20], ecx
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x74]
xor eax, eax
mov ecx, 0x10
lea edi, [edx + 0x1be]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xfc]
test eax, eax
jg 0x4787c7
jl 0x4787b6
cmp dword [esp + 0xf8], 1
jae 0x4787c7
or eax, 0xffffffff
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x78]
shl eax, 4
push 1
lea esi, [eax + edx]
push ecx
mov ecx, dword [esp + 0x40]
lea eax, [esi + 0x1bf]
push edi
lea edx, [eax + 1]
push edx
push eax
add eax, 2
push eax
mov eax, dword [esp + 0x54]
push eax
push ecx
mov dword [esi + 0x1c2], 0xee
call fcn.00447370
mov edx, dword [esp + 0xa0]
push 1
push edx
mov edx, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x124]
lea eax, [esi + 0x1c3]
lea ecx, [eax + 1]
push ecx
push eax
add eax, 2
push eax
push edx
push edi
call fcn.00447370
mov eax, dword [esp + 0x78]
mov dword [esi + 0x1c6], eax
add esp, 0x40
mov dword [esi + 0x1ca], edi
jmp 0x478c7a
mov al, byte [esp + 0xa3]
test al, al
je 0x478866
test esi, esi
jl 0x478c7e
mov esi, dword [esp + 0x30]
mov al, byte [esp + 0x2f]
test al, al
mov ecx, dword [esp + 0x70]
je 0x4788fd
mov eax, dword [esp + 0x60]
xor esi, esi
test eax, eax
mov byte [esp + 0x8f], 0
mov dword [esp + 0x30], 0xffffffff
jbe 0x4788f9
mov dword [esp + 0xac], ecx
jmp 0x4788a0
mov ecx, dword [esp + 0xac]
mov eax, 0x10
mov edx, 0x4f7ab8
call fcn.00449820
test eax, eax
jne 0x4788d9
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0x60]
inc esi
add ecx, 0x80
cmp esi, eax
mov dword [esp + 0xac], ecx
jb 0x4788a0
jmp 0x4788f5
mov edx, dword [esp + 0x70]
mov edi, esi
shl edi, 7
xor eax, eax
add edi, edx
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
mov dword [esp + 0x30], esi
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x30]
dec dword [esp + 0xc4]
mov eax, dword [esp + 0x60]
cmp esi, eax
jae 0x477658
cmp dword [esp + 0xc4], eax
jge 0x477658
mov al, byte [esp + 0x8f]
test al, al
je 0x478a85
mov dl, byte [esp + 0x35]
xor eax, eax
test dl, dl
je 0x47899a
lea edx, [ecx + 0x20]
lea esp, [esp]
cmp eax, dword [esp + 0x60]
jae 0x47899a
mov edi, dword [edx]
cmp edi, dword [esp + 0x38]
jne 0x478957
mov edi, dword [edx + 4]
cmp edi, dword [esp + 0x3c]
je 0x478960
inc eax
add edx, 0x80
jmp 0x478940
mov edx, eax
shl edx, 7
cmp eax, esi
lea edi, [edx + ecx]
mov edx, dword [0x4f7ab8]
mov ecx, edi
mov dword [ecx], edx
mov edx, dword [0x4f7abc]
mov dword [ecx + 4], edx
mov edx, dword [0x4f7ac0]
mov dword [ecx + 8], edx
mov edx, dword [0x4f7ac4]
mov dword [ecx + 0xc], edx
je 0x47899a
mov ecx, 0x20
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x70]
mov eax, esi
shl eax, 7
lea edi, [eax + ecx]
mov eax, 0x10
mov edx, 0x4f7ab8
mov ecx, edi
mov dword [esp + 0x11c], edi
call fcn.00449820
test eax, eax
jne 0x478a6d
mov eax, dword [esp + 0x60]
inc esi
cmp esi, eax
mov dword [esp + 0xac], esi
jae 0x477658
mov eax, dword [esp + 0x70]
mov edi, esi
shl edi, 7
add edi, eax
jmp 0x4789f0
mov eax, 0x10
mov edx, 0x4f7ab8
mov ecx, edi
call fcn.00449820
test eax, eax
jne 0x478a20
mov eax, dword [esp + 0x60]
inc esi
add edi, 0x80
cmp esi, eax
mov dword [esp + 0xac], esi
jb 0x4789f0
jmp 0x477658
mov eax, dword [esp + 0x30]
cmp esi, eax
jle 0x478a51
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0x70]
mov edi, edx
shl edi, 7
add edi, ecx
sub edx, eax
lea esp, [esp]
dec edx
lea eax, [edi - 0x80]
mov ecx, 0x20
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
jne 0x478a40
mov edx, dword [esp + 0x60]
cmp dword [esp + 0xac], edx
jae 0x477658
mov edi, dword [esp + 0x11c]
mov esi, dword [esp + 0x30]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x134], eax
mov edx, dword [esp + 0xc4]
test edx, edx
mov eax, 1
jge 0x478bfb
mov edx, dword [esp + 0x134]
test edx, edx
jne 0x478ad0
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1c0], eax
jmp 0x478adb
mov eax, dword [esp + 0x1d4]
test eax, eax
jle 0x478b09
mov edx, dword [esp + 0x1c4]
mov eax, esi
shl eax, 7
add eax, ecx
mov dword [eax], edx
mov edx, dword [esp + 0x1c8]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1cc]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x1d0]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x1ac]
test eax, eax
jle 0x478b44
mov eax, esi
shl eax, 7
lea edx, [eax + ecx + 0x10]
mov eax, dword [esp + 0x218]
mov dword [edx], eax
mov eax, dword [esp + 0x21c]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x220]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x224]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x194]
test eax, eax
jle 0x478b64
mov eax, dword [esp + 0x38]
mov edx, esi
shl edx, 7
mov dword [edx + ecx + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [edx + ecx + 0x24], eax
mov eax, dword [esp + 0x1bc]
test eax, eax
jle 0x478b8a
mov eax, dword [esp + 0xf8]
mov edx, esi
shl edx, 7
mov dword [edx + ecx + 0x28], eax
mov eax, dword [esp + 0xfc]
mov dword [edx + ecx + 0x2c], eax
mov eax, dword [esp + 0x1a8]
test eax, eax
jle 0x478bae
mov edx, dword [esp + 0x210]
mov eax, dword [esp + 0x214]
shl esi, 7
mov dword [esi + ecx + 0x30], edx
mov dword [esi + ecx + 0x34], eax
mov eax, dword [esp + 0x1c0]
test eax, eax
jle 0x478c5c
mov ecx, dword [esp + 0x130]
cmp word [ecx], 0
je 0x478c5c
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x70]
shl edx, 7
lea edx, [edx + eax + 0x38]
xor eax, eax
mov edi, edx
mov ecx, 0x12
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x130]
push 0x24
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x478c58
cmp edx, esi
je 0x478c5c
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x70]
shl eax, 7
add eax, edx
mov esi, eax
mov ecx, 0x20
lea edi, [esp + 0x310]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc4]
shl ecx, 7
add edx, ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp + 0x30]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov edi, edx
mov edx, dword [esp + 0xc4]
cmp eax, edx
mov ecx, 0x20
lea esi, [esp + 0x310]
rep movsd dword es:[edi], dword [esi]
jge 0x478c58
mov eax, edx
mov dword [esp + 0x30], eax
mov edi, dword [esp + 0x68]
mov al, byte [esp + 0x5f]
test al, al
je 0x478c7e
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x70]
shl edi, 7
xor eax, eax
mov ecx, 0x20
add edi, edx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
mov cl, byte [esp + 0xa3]
xor eax, eax
test cl, cl
mov dword [esp + 0x78], eax
je 0x478dd6
mov cl, byte [esp + 0x37]
test cl, cl
jne 0x478dd6
cmp dword [esp + 0x60], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0x44], eax
jle 0x478dd6
mov esi, dword [esp + 0x70]
mov dword [esp + 0xac], esi
mov dword [esp + 0x88], esi
jmp 0x478cd0
mov eax, 0x10
mov edx, 0x4f7ab8
mov ecx, esi
call fcn.00449820
test al, al
jne 0x478cfd
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0xb8]
mov dword [esp + 0x118], 0
je 0x478d08
mov dword [esp + 0x118], 1
xor edx, edx
test al, al
jne 0x478d6d
mov eax, dword [esp + 0x44]
cmp eax, dword [esp + 0xb8]
je 0x478d4b
mov esi, dword [esp + 0xac]
mov eax, 0x10
mov edx, esi
mov ecx, esi
call fcn.00449820
mov edi, dword [esp + 0x88]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0xac]
mov edx, eax
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0x88]
inc ecx
add eax, 0x80
mov dword [esp + 0xb8], ecx
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x118]
test eax, eax
je 0x478da7
lea ecx, [esi + 0x80]
cmp esi, ecx
mov eax, esi
jae 0x478d98
mov edi, dword [eax]
add eax, 4
test edi, edi
jne 0x478d93
cmp eax, ecx
jb 0x478d84
jmp 0x478d98
mov edx, 1
mov ecx, 0x20
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
test edx, edx
je 0x478db4
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [esp + 0x78], ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x60]
inc eax
add esi, 0x80
cmp eax, ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0xac], esi
jl 0x478cd0
mov edx, dword [esp + 0x74]
push edx
call fcn.00447470
lea eax, [ebx - 0x174]
push eax
call fcn.00447470
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x80]
add esp, 8
cmp ecx, eax
jg 0x478e03
inc eax
mov dword [esp + 0x78], eax
mov al, byte [esp + 0x37]
test al, al
je 0x478e13
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x78], ecx
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x70]
shl eax, 7
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x60]
push 0
shl eax, 7
push eax
push edx
call fcn.004a2fb0
mov ecx, dword [esp + 0xc0]
mov dword [ebx + 0x58], eax
mov dword [ecx + 0x58], eax
mov esi, dword [ebx + 0xc]
add esp, 0xc
cmp esi, 0x20000
mov dword [ebx + 0x10], 0
ja 0x477658
push 0
push esi
push ebx
call fcn.004a2fb0
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc0]
push 0
push esi
push eax
mov dword [eax + 0x10], 0
call fcn.004a2fb0
mov edx, dword [esp + 0xcc]
mov dword [edx + 0x10], eax
mov eax, dword [esp + 0x134]
lea eax, [edi + eax - 1]
xor edx, edx
div edi
add esp, 0x18
imul eax, edi
mov dword [esp + 0x118], eax
mov al, byte [esp + 0x37]
test al, al
je 0x478eca
push 0
push 0
push 0
lea ecx, [esp + 0x18]
call fcn.0041ebdc
mov ecx, dword [esp + 0x74]
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.00443780
mov edx, dword [esp + 0x174]
mov eax, dword [esp + 0x170]
xor esi, esi
push esi
push edx
push eax
push esi
push edi
call fcn.004b4970
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.0041ebdc
mov ecx, dword [esp + 0x118]
lea edx, [edi + ecx]
push edx
push ebx
lea ecx, [esp + 0x14]
call fcn.00443780
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x14c]
push esi
push esi
sub eax, 0x20
push edi
sbb ecx, esi
push ecx
push eax
call fcn.004b4970
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.0041ebdc
mov edx, dword [esp + 0x118]
push edx
push ebx
lea ecx, [esp + 0x14]
call fcn.00443780
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x148]
push esi
push eax
push ecx
push esi
push edi
call fcn.004b4970
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.0041ebdc
mov edx, dword [esp + 0xb4]
push edi
push edx
lea ecx, [esp + 0x14]
call fcn.00443780
mov al, byte [esp + 0x2e]
test al, al
je 0x478f89
mov esi, dword [esp + 0xc]
mov byte [esp + 0x2e], 0
call fcn.00447420
mov al, byte [esp + 0x36]
test al, al
je 0x47a10b
lea ecx, [esp + 0x74]
call fcn.00443880
lea ecx, [esp + 0x28]
mov byte [esp + 0x66c], 8
call fcn.00443880
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov al, byte [esp + 0x2e]
test al, al
je 0x478fc2
call fcn.00447420
cmp esi, ebx
je 0x478fd2
cmp esi, 0xffffffff
je 0x478fd2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], ebx
mov cl, byte [esp + 0x36]
xor eax, eax
test cl, 0x20
jne 0x478feb
cmp dword [esp + 0xe4], 0xc
je 0x479004
mov eax, dword [esp + 0x12c]
push 1
push ebx
push eax
call fcn.0044e940
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, byte [esp + 0x6f]
test cl, cl
je 0x47a02b
cmp dword [esp + 0x98], ebx
je 0x47a02b
mov esi, dword [esp + 0xc]
jmp 0x47678d
cmp dword [esp + 0xc0], ebx
jge 0x4790a2
mov edx, dword [esp + 0x10]
cmp word [edx], bx
jne 0x4790a2
cmp edi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x47904f
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push ebx
push eax
call esi
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x479074
mov ecx, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
call fcn.00417bd9
add esp, 0x14
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x47908a
cmp eax, 0xffffffff
je 0x47908a
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x47966f
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x47966f
xor eax, eax
or ebx, 0xffffffff
mov dword [esp + 0x90], ebx
mov esi, str.INDATA
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x94]
cmp word [ecx], ax
mov byte [esp + 0x66c], 0xb
je 0x47920a
mov edx, ecx
push edx
push 0x4fa5ac
call fcn.00444a10
add esp, 8
test al, al
jne 0x47920a
mov eax, dword [esp + 0x94]
push eax
push 0x4f64a4
call fcn.00444a10
add esp, 8
test al, al
jne 0x47920a
mov ecx, dword [esp + 0x94]
push ecx
push 0x4fa5a8
call fcn.00444a10
add esp, 8
test al, al
je 0x47914a
mov eax, 0xe
jmp 0x47920f
mov edx, dword [esp + 0x94]
push edx
push 0x4fa5a4
call fcn.00444a10
add esp, 8
test al, al
je 0x47916d
mov eax, 0xf
jmp 0x47920f
mov eax, dword [esp + 0x94]
mov dword [esp + 0x90], 0
cmp word [eax], 0x2a
jne 0x4791c5
add eax, 2
mov dword [esp + 0x94], eax
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.0044f5a0
mov eax, dword [esp + 0x9c]
mov ebx, dword [esp + 0x148]
add esp, 8
cmp word [eax], 0x2a
jne 0x4791c5
add eax, 2
mov dword [esp + 0x94], eax
cmp word [eax], 0x23
jne 0x4791e7
mov edx, dword [esp + 0x94]
push edx
lea ecx, [esp + 0x48]
call fcn.004566f0
mov eax, dword [esp + 0x44]
mov esi, str.EXEDATA
jmp 0x47920f
lea ecx, [esp + 0x90]
push ecx
push 0
push eax
call fcn.0041f3a1
mov ecx, dword [esp + 0x9c]
add esp, 0xc
mov dword [esp + 0x108], eax
jmp 0x479233
mov eax, 0x10
push 0
lea edx, [esp + 0x10c]
push edx
push esi
push eax
push 0
call fcn.00423fea
mov ecx, dword [esp + 0x120]
add esp, 0x14
mov dword [esp + 0x90], ecx
mov edx, dword [esp + 0x144]
test edx, edx
mov dword [esp + 0x98], eax
jl 0x479267
jg 0x47924b
test ebx, ebx
jb 0x479267
mov esi, dword [esp + 0x144]
xor edx, edx
cmp edx, esi
jl 0x479267
jg 0x47925e
cmp ecx, ebx
jbe 0x479267
mov ecx, ebx
mov dword [esp + 0x90], ecx
test ecx, ecx
jbe 0x4794e5
test eax, eax
je 0x4794e5
mov eax, dword [esp + 0x12c]
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
push eax
lea ecx, [esp + 0x28]
call fcn.00417e55
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4792e9
lea ecx, [esp + 0x44]
call fcn.00443880
lea ecx, [esp + 0x108]
call fcn.00416732
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
mov eax, dword [esp + 0x24]
test eax, eax
je 0x47848a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x47848a
mov ebx, dword [esp + 0x90]
add ebx, 0x1ff
and ebx, 0xfffffe00
lea ecx, [ebx + ebx + 0x200]
push ecx
lea ecx, [esp + 0x80]
call fcn.004492b0
mov eax, dword [esp + 0x7c]
add eax, 0x200
push 0
and eax, 0xfffffe00
lea edx, [esp + 0xc0]
push edx
mov dword [esp + 0x138], eax
add eax, ebx
push ebx
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4793ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x479353
mov esi, 1
lea ecx, [esp + 0x7c]
call fcn.00443880
lea ecx, [esp + 0x44]
call fcn.00443880
lea ecx, [esp + 0x108]
call fcn.00416732
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
mov eax, dword [esp + 0x24]
test eax, eax
je 0x479ec8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x479ec8
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0xc]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [edi + ebx]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, edx
push 0
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x479421
lea ecx, [esp + 0x7c]
call fcn.00443880
lea ecx, [esp + 0x44]
call fcn.00443880
lea ecx, [esp + 0x108]
call fcn.00416732
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
jmp 0x4792d1
mov ecx, dword [esp + 0x90]
cmp ecx, 0x1b8
jle 0x479435
mov ecx, 0x1b8
mov edx, dword [esp + 0x130]
mov esi, dword [esp + 0x98]
lea eax, [edx + ebx]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + 0x1fe], 0x55
mov byte [eax + 0x1ff], 0xaa
mov ecx, dword [esp + 0x90]
cmp ecx, 0x200
jbe 0x47949a
mov esi, dword [esp + 0x98]
add ecx, 0xfffffe00
lea edi, [eax + 0x200]
mov eax, ecx
shr ecx, 2
add esi, 0x200
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x130]
lea edi, [ecx + ebx]
mov eax, ebx
mov edx, edi
mov esi, 1
call fcn.00449820
test eax, eax
jne 0x4794d7
push eax
lea ecx, [esp + 0xc0]
push ecx
push ebx
push edi
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call fcn.00447400
add esp, 4
xor edx, edx
test esi, esi
sete dl
mov esi, edx
jmp 0x479353
mov eax, dword [esp + 0x44]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x479501
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x108]
test eax, eax
je 0x47951b
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
test edi, edi
mov dword [esp + 0x108], 0
je 0x479539
mov edx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push edx
call esi
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x47955e
mov eax, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00417bd9
add esp, 0x14
mov eax, dword [esp + 0xc]
test eax, eax
je 0x479572
cmp eax, 0xffffffff
je 0x479572
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x479581
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x479598
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4795af
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4795c5
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4795dc
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4784b7
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
jmp 0x4784b7
mov ecx, dword [esp + 0x30]
cmp ecx, ebx
jg 0x4796e1
cmp edi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x47961f
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push ebx
push eax
call esi
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x479644
mov ecx, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
call fcn.00417bd9
add esp, 0x14
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x47965a
cmp eax, 0xffffffff
je 0x47965a
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x479669
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x10], ebx
je 0x479681
mov eax, dword [esp + 0x10]
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x479697
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4796ac
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4796c2
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4776ba
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
jmp 0x4776ba
mov eax, dword [esp + 0xc0]
cmp eax, ebx
jge 0x479730
mov edx, dword [esp + 0x10]
cmp word [edx], bx
jne 0x479730
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x47768d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x47768d
mov edx, dword [esp + 0x190]
push edx
lea edx, [esp + 0xe8]
push edx
lea edx, [esp + 0x100]
push edx
mov edx, dword [esp + 0xb4]
push edx
push ecx
push eax
lea eax, [esp + 0x2c]
or edi, 0xffffffff
push eax
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x100], edi
call fcn.0045ec80
mov eax, dword [esp + 0x100]
add esp, 0x1c
cmp eax, ebx
jg 0x4797ba
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4797af
cmp eax, edi
je 0x4797af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebx
jmp 0x4792d7
mov dword [esp + 0x68], 0x200
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
cmp word [esi], bx
mov byte [esp + 0x66c], 0xd
je 0x4799b4
push esi
push 0x4fa5ac
call fcn.00444a10
add esp, 8
test al, al
jne 0x4799b4
push esi
push 0x4f64a4
call fcn.00444a10
add esp, 8
test al, al
jne 0x4799b4
push esi
push 0x4fa5a4
call fcn.00444a10
add esp, 8
test al, al
je 0x479830
mov eax, 8
jmp 0x4799b9
push esi
push str.nt6fat
call fcn.00444a10
add esp, 8
test al, al
jne 0x4799ad
push esi
push str.winfat
call fcn.00444a10
add esp, 8
test al, al
jne 0x4799ad
push esi
push 0x4fa5a8
call fcn.00444a10
add esp, 8
test al, al
je 0x479878
mov eax, 6
jmp 0x4799b9
push esi
push str.nt5fat
call fcn.00444a10
add esp, 8
test al, al
je 0x479894
mov eax, 5
jmp 0x4799b9
mov dword [esp + 0x68], ebx
cmp word [esi], 0x2a
mov dword [esp + 0x170], edi
mov dword [esp + 0x174], edi
jne 0x4798ec
lea ecx, [esp + 0x170]
push ecx
lea edx, [esp + 0xf0]
add esi, 2
push edx
mov dword [esp + 0xf4], esi
call fcn.0044f5a0
mov esi, dword [esp + 0xf4]
mov edi, dword [esp + 0x178]
add esp, 8
cmp word [esi], 0x2a
jne 0x4798ec
add esi, 2
mov dword [esp + 0xec], esi
cmp word [esi], 0x23
mov eax, dword [esp + 0xec]
jne 0x479952
push eax
lea ecx, [esp + 0x120]
call fcn.004134f5
mov eax, dword [eax]
push ebx
lea ecx, [esp + 0x10c]
push ecx
push str.EXEDATA
push eax
push ebx
mov byte [esp + 0x680], 0xe
call fcn.00423fea
mov esi, eax
add esp, 0x14
lea ecx, [esp + 0x11c]
mov dword [esp + 0xb4], esi
mov byte [esp + 0x66c], 0xd
call fcn.00443880
mov eax, dword [esp + 0x10c]
mov dword [esp + 0x68], eax
jmp 0x479975
lea edx, [esp + 0x68]
push edx
push ebx
push eax
call fcn.0041f3a1
mov esi, eax
mov eax, dword [esp + 0x74]
add esp, 0xc
mov dword [esp + 0xb4], esi
mov dword [esp + 0x108], esi
mov edx, dword [esp + 0x174]
cmp edx, ebx
jl 0x479998
jg 0x479986
cmp edi, ebx
jb 0x479998
xor ecx, ecx
cmp ecx, edx
jl 0x479998
jg 0x479992
cmp eax, edi
jbe 0x479998
mov eax, edi
mov dword [esp + 0x68], eax
cmp esi, ebx
jne 0x4799f1
lea ecx, [esp + 0x108]
call fcn.00416732
jmp 0x47845e
mov eax, 7
jmp 0x4799b9
mov eax, 9
push ebx
lea ecx, [esp + 0x10c]
push ecx
push str.INDATA
push eax
push ebx
call fcn.00423fea
mov esi, eax
mov eax, dword [esp + 0x7c]
add esp, 0x14
cmp eax, ebx
mov dword [esp + 0xb4], esi
je 0x479c06
mov eax, dword [esp + 0x10c]
mov dword [esp + 0x68], eax
cmp eax, ebx
jbe 0x479c06
cmp esi, ebx
je 0x479c06
mov edx, dword [esp + 0x12c]
push ebx
push 0x20000000
push 3
push ebx
push 3
push 0xc0000000
push edx
lea ecx, [esp + 0x28]
call fcn.00417e55
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x47999c
mov edi, dword [esp + 0xfc]
mov esi, dword [esp + 0xf8]
push ebx
push edi
push esi
push eax
call fcn.00444930
add esp, 0x10
cmp eax, esi
jne 0x47999c
cmp edx, edi
jne 0x47999c
mov ebx, dword [esp + 0x68]
add ebx, 0x1ff
and ebx, 0xfffffe00
lea eax, [ebx + ebx + 0x200]
push eax
lea ecx, [esp + 0xf8]
call fcn.004492b0
mov eax, dword [esp + 0xf4]
mov edx, dword [esp + 0xc]
push 0
add eax, 0x200
and eax, 0xfffffe00
lea ecx, [esp + 0xc0]
push ecx
mov dword [esp + 0x84], eax
push ebx
add eax, ebx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x479ace
lea ecx, [esp + 0xf4]
call fcn.00443880
lea ecx, [esp + 0x108]
call fcn.00416732
jmp 0x47845e
mov edi, dword [esp + 0x7c]
mov edx, dword [esp + 0xf8]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [edi + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xfc]
push 0
push ecx
push edx
push eax
call fcn.00444930
mov ecx, dword [esp + 0x108]
add esp, 0x10
cmp eax, ecx
jne 0x479ab1
cmp edx, dword [esp + 0xfc]
jne 0x479ab1
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0x7c]
mov si, word [edx]
mov eax, dword [esp + 0x68]
add ecx, ebx
cmp eax, 0x1fe
mov word [ecx], si
mov dl, byte [edx + 2]
mov byte [ecx + 2], dl
jle 0x479b41
mov eax, 0x1fe
mov esi, dword [esp + 0xb4]
lea ecx, [eax - 0x1e]
mov eax, dword [esp + 0x7c]
mov edx, ecx
add eax, ebx
shr ecx, 2
add esi, 0x1e
lea edi, [eax + 0x1e]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + 0x1fe], 0x55
mov byte [eax + 0x1ff], 0xaa
mov ecx, dword [esp + 0x68]
cmp ecx, 0x200
jbe 0x479ba6
mov esi, dword [esp + 0xb4]
add ecx, 0xfffffe00
lea edi, [eax + 0x200]
mov eax, ecx
shr ecx, 2
add esi, 0x200
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x7c]
lea edi, [ecx + ebx]
mov eax, ebx
mov edx, edi
mov esi, 1
call fcn.00449820
test eax, eax
jne 0x479be0
push eax
lea ecx, [esp + 0xc0]
push ecx
push ebx
push edi
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call fcn.00447400
add esp, 4
xor edx, edx
test esi, esi
sete dl
lea ecx, [esp + 0xf4]
mov esi, edx
call fcn.00443880
lea ecx, [esp + 0x108]
call fcn.00416732
jmp 0x479e9c
lea ecx, [esp + 0x108]
call fcn.00416732
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
mov eax, dword [esp + 0x24]
cmp eax, ebx
jmp 0x4792d7
mov al, byte [esp + 0xb1]
test al, al
je 0x479c54
cmp dword [esp + 0x104], ebx
jl 0x479cd1
mov al, byte [esp + 0x86]
mov ecx, dword [esp + 0x104]
mov esi, dword [esp + 0x188]
neg al
sbb eax, eax
and eax, 0x200000
or eax, ecx
or eax, esi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0045e640
add esp, 8
jmp 0x479cd1
mov eax, dword [esp + 0x104]
cmp eax, ebx
jl 0x479cd1
mov cl, byte [esp + 0xa5]
test cl, cl
je 0x479ca2
cmp dword [esp + 0x30], ebx
jl 0x479cd1
mov ecx, dword [esp + 0x190]
movsx edx, byte [esp + 0x86]
mov esi, dword [esp + 0xa8]
push ecx
mov ecx, dword [esp + 0x34]
push ebx
push ebx
or edx, esi
push edx
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0045ec80
add esp, 0x1c
mov eax, dword [esp + 0x1fc]
cmp eax, ebx
jle 0x479cf1
push eax
mov eax, dword [esp + 0x188]
push eax
lea eax, [esp + 0x1c]
call fcn.0044f560
add esp, 8
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x188]
push ebx
call fcn.00448be0
test edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x479d20
mov edx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push edx
call esi
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x479d45
mov eax, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00417bd9
add esp, 0x14
mov eax, dword [esp + 0xc]
test eax, eax
je 0x479d59
cmp eax, 0xffffffff
je 0x479d59
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x479d68
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x479d7f
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
test ebx, ebx
je 0x479d92
mov edx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x479da8
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x479dbf
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47a16d
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
xor eax, eax
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
cmp ax, bx
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
je 0x479e38
mov edx, dword [esp + 0x190]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x104]
push edx
push ebx
and eax, 0xfffffffd
push ebx
or eax, 0xc
push eax
mov eax, dword [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.0045ec80
add esp, 0x1c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x18c]
call fcn.00448be0
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x47a140
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x47a140
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x479e9a
mov esi, dword [esp + 0xc]
call fcn.00447420
mov esi, eax
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov eax, esi
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov eax, dword [esp + 0x18c]
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x9c]
jmp 0x478459
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0xf4]
call fcn.00443880
lea ecx, [esp + 0x74]
jmp 0x478459
lea ecx, [esp + 0xf4]
call fcn.00443880
jmp 0x477658
cmp byte [esp + 0x67], 0x10
mov edi, eax
je 0x47a038
mov edi, dword [esp + 0x7c]
mov al, byte [esp + 0x58]
test al, al
mov byte [esp + 0x66c], 7
je 0x47a05d
mov edx, dword [esp + 0x54]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.00417bd9
add esp, 0x14
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x47a071
cmp eax, 0xffffffff
je 0x47a071
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x47a080
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x47a09b
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x47a0b1
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x47a0c7
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push edx
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x47a0dc
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push ebx
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x47a0f2
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call esi
mov eax, edi
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x74]
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x54]
mov byte [esp + 0x66c], 7
call fcn.0044fb20
lea ecx, [esp + 0xc]
call fcn.00417e50
lea ecx, [esp + 0x24]
call fcn.0041ebce
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
mov ecx, dword [esp + 0x664]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8