Function at 0x47876e
Capabilities:
Get common file path
Set current directory

Disassembly:
push 0x24c
mov eax, 0x5ce917
call fcn.00506dfb
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x22c], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
call fcn.0056b050
add esp, 0xc
call fcn.00430f47
test eax, eax
je 0x4787c3
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0x104
add esi, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
lea ecx, [ebp - 0x238]
call fcn.00413f09
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x244]
call fcn.00413f09
push str._rundll32.exe
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 2
call fcn.0043193c
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0042dfbd
add esp, 0xc
mov byte [ebp - 4], 3
call fcn.0041279d
push eax
lea ecx, [ebp - 0x228]
call fcn.00411d94
mov byte [ebp - 4], 4
call fcn.0041279d
push eax
lea ecx, [ebp - 0x250]
call fcn.00411d94
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
push eax
call fcn.00412393
lea esi, [eax + 0x10]
mov dword [ebp - 0x220], esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 6
mov dword [esp], 0x5f1b30
call fcn.0042e677
test eax, eax
jne 0x4788e1
push 0x5f1b30
mov ecx, edi
call fcn.00413f09
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
jmp 0x4799b4
lea ecx, [ebp - 0x220]
call fcn.0043193c
xor esi, esi
lea ecx, [ebp - 0x220]
push esi
mov edi, str.rundll32.exe
push edi
call fcn.0042ea61
cmp eax, 0xffffffff
jne 0x4789b5
push esi
mov edi, str.rundll32
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
test eax, eax
jne 0x4789b0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042e677
test eax, eax
je 0x4789b0
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 8
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 7
call fcn.00411f3a
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 8
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp + 0xc]
call fcn.00411f3a
mov ecx, dword [ebp - 0x230]
jmp 0x4795c8
mov edi, str.rundll32.exe
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
test eax, eax
jne 0x478a44
push edi
lea ecx, [ebp - 0x220]
call fcn.0042e677
test eax, eax
je 0x478a44
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 9
call fcn.00411f3a
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0xa
jmp 0x47899c
push esi
mov edi, 0x60e764
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
test eax, eax
jne 0x478afa
push edi
lea ecx, [ebp - 0x220]
call fcn.0042e677
test eax, eax
je 0x478afa
push 0x5f1b30
push 0x60cdbc
lea ecx, [ebp - 0x220]
call fcn.00434b1c
push esi
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0xb
call fcn.00411f3a
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0xc
jmp 0x47899c
mov edi, str._rundll32.exe
lea ecx, [ebp - 0x238]
push edi
call fcn.0043193c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042dfbd
add esp, 0xc
push 2
pop ebx
push esi
push dword [eax]
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x22c], ebx
call fcn.0042ea61
test eax, eax
jne 0x478b80
push edi
lea ecx, [ebp - 0x238]
call fcn.0043193c
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0042dfbd
add esp, 0xc
push 6
pop ebx
push dword [eax]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
test eax, eax
je 0x478b80
mov byte [ebp - 0x219], 1
jmp 0x478b89
mov byte [ebp - 0x219], 0
xor esi, esi
test bl, 4
je 0x478b9f
mov ecx, dword [ebp - 0x230]
and ebx, 0xfffffffb
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x224]
and ebx, 0xfffffffd
mov dword [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
je 0x478c48
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0xf
call fcn.00411f3a
mov ecx, dword [ebp - 0x224]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp + 0xc]
call fcn.00411f3a
mov ecx, dword [ebp - 0x224]
jmp 0x4795c8
push edi
lea ecx, [ebp - 0x238]
call fcn.0043193c
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0042dfbd
add esp, 0xc
push esi
push dword [eax]
or ebx, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042ea61
cmp eax, 1
jne 0x478cc8
push edi
lea ecx, [ebp - 0x238]
call fcn.0043193c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
or ebx, 0x10
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x478ccf
mov byte [ebp - 0x219], 0
test bl, 0x10
je 0x478ce5
mov ecx, dword [ebp - 0x224]
and ebx, 0xffffffef
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x230]
and ebx, 0xfffffff7
mov dword [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
je 0x478d7b
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xd
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x13
call fcn.00411f3a
mov ecx, dword [ebp - 0x224]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xd
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x14
jmp 0x478c34
call fcn.00430f47
test eax, eax
je 0x478ddc
push 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x220]
call fcn.0042ea61
test eax, eax
jne 0x478ddc
push edi
lea ecx, [ebp - 0x244]
call fcn.0043193c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
or ebx, 0x20
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x478de3
mov byte [ebp - 0x219], 0
mov dword [ebp - 4], 6
test bl, 0x20
je 0x478e00
mov ecx, dword [ebp - 0x224]
and ebx, 0xffffffdf
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
je 0x478e7e
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x16
call fcn.00411f3a
mov ecx, dword [ebp - 0x224]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x17
jmp 0x478c34
call fcn.00430f47
test eax, eax
je 0x478ee0
push 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x220]
call fcn.0042ea61
cmp eax, 1
jne 0x478ee0
push edi
lea ecx, [ebp - 0x244]
call fcn.0043193c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
or ebx, 0x40
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x478ee7
mov byte [ebp - 0x219], 0
mov dword [ebp - 4], 6
test bl, 0x40
je 0x478f04
mov ecx, dword [ebp - 0x224]
and ebx, 0xffffffbf
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
mov esi, ebx
je 0x478f84
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xd
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x19
call fcn.00411f3a
mov ecx, dword [ebp - 0x224]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xd
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x1a
jmp 0x478c34
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00434d0c
or ebx, 0x80
mov byte [ebp - 4], 0x1b
push edi
mov ecx, eax
mov dword [ebp - 0x22c], ebx
call fcn.0043193c
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0042dfbd
add esp, 0xc
mov ebx, esi
mov dword [ebp - 4], 0x1c
push 0
push dword [eax]
or ebx, 0x180
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
mov esi, ebx
call fcn.0042ea61
test eax, eax
jne 0x479068
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00434d0c
or ebx, 0x200
mov dword [ebp - 4], 0x1d
push edi
mov ecx, eax
mov dword [ebp - 0x22c], ebx
call fcn.0043193c
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
mov ebx, esi
mov dword [ebp - 4], 0x1e
or ebx, 0x600
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x47906f
mov byte [ebp - 0x219], 0
test ebx, 0x400
je 0x47908b
mov ecx, dword [ebp - 0x224]
and ebx, 0xfffffbff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test ebx, 0x200
je 0x4790a7
mov ecx, dword [ebp - 0x230]
and ebx, 0xfffffdff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x24c]
and ebx, 0xfffffeff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x240]
and ebx, 0xffffff7f
mov dword [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
mov esi, ebx
je 0x479169
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x1f
call fcn.00411f3a
mov ecx, dword [ebp - 0x240]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp + 0xc]
call fcn.00411f3a
mov ecx, dword [ebp - 0x240]
jmp 0x4795c8
lea ecx, [ebp - 0x238]
call fcn.0043193c
push eax
lea eax, [ebp - 0x230]
push 0x60cdbc
push eax
call fcn.0042e01c
push str._rundll32.exe_
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0x21
or ebx, 0x800
push eax
mov dword [ebp - 0x22c], ebx
call fcn.0042dfbd
add esp, 0x18
mov ebx, esi
mov dword [ebp - 4], 0x22
push 0
push dword [eax]
or ebx, 0x1800
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
mov esi, ebx
call fcn.0042ea61
mov edi, 0x2000
test eax, eax
jne 0x479248
lea ecx, [ebp - 0x238]
call fcn.0043193c
push eax
lea eax, [ebp - 0x24c]
push 0x60cdbc
push eax
call fcn.0042e01c
push str._rundll32.exe_
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 4], 0x23
or ebx, edi
push eax
mov dword [ebp - 0x22c], ebx
call fcn.0042dfbd
add esp, 0x18
push dword [eax]
mov ebx, esi
mov dword [ebp - 4], 0x24
or ebx, 0x6000
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x47924f
mov byte [ebp - 0x219], 0
test ebx, 0x4000
je 0x47926b
mov ecx, dword [ebp - 0x240]
and ebx, 0xffffbfff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test edi, ebx
je 0x479283
mov ecx, dword [ebp - 0x24c]
and ebx, 0xffffdfff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x224]
and ebx, 0xffffefff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x230]
and ebx, 0xfffff7ff
mov dword [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
mov esi, ebx
mov edi, ebx
je 0x47934d
push 0x5f1b30
push 0x60cdbc
lea ecx, [ebp - 0x220]
call fcn.00434b1c
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x25
call fcn.00411f3a
mov ecx, dword [ebp - 0x240]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0043198c
mov byte [ebp - 4], 0x26
jmp 0x479155
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00434d0c
or ebx, 0x8000
mov byte [ebp - 4], 0x27
mov ecx, eax
mov dword [ebp - 0x22c], ebx
call fcn.0043193c
push eax
lea eax, [ebp - 0x254]
push 0x60cdbc
push eax
call fcn.0042e01c
push str._rundll32.exe_
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0x28
or esi, 0x18000
push eax
mov dword [ebp - 0x22c], esi
call fcn.0042dfbd
add esp, 0x18
mov ebx, edi
mov dword [ebp - 4], 0x29
push 0
push dword [eax]
or ebx, 0x38000
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
mov esi, ebx
mov edi, ebx
call fcn.0042ea61
test eax, eax
jne 0x479489
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x238]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00434d0c
or ebx, 0x40000
mov dword [ebp - 4], 0x2a
mov ecx, eax
mov dword [ebp - 0x22c], ebx
call fcn.0043193c
push eax
lea eax, [ebp - 0x24c]
push 0x60cdbc
push eax
call fcn.0042e01c
push str._rundll32.exe_
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 4], 0x2b
or esi, 0xc0000
push eax
mov dword [ebp - 0x22c], esi
call fcn.0042dfbd
add esp, 0x18
push dword [eax]
mov ebx, edi
mov dword [ebp - 4], 0x2c
or ebx, 0x1c0000
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
jne 0x479490
mov byte [ebp - 0x219], 0
test ebx, 0x100000
je 0x4794ac
mov ecx, dword [ebp - 0x240]
and ebx, 0xffefffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test ebx, 0x80000
je 0x4794c8
mov ecx, dword [ebp - 0x24c]
and ebx, 0xfff7ffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test ebx, 0x40000
je 0x4794e4
mov ecx, dword [ebp - 0x224]
and ebx, 0xfffbffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x230]
and ebx, 0xfffdffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x254]
and ebx, 0xfffeffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x234]
and ebx, 0xffff7fff
mov dword [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
push 0x5f1b30
je 0x479944
push 0x60cdbc
lea ecx, [ebp - 0x220]
call fcn.00434b1c
push 0
mov edi, str.rundll32.exe
lea ecx, [ebp - 0x220]
push edi
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x2d
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x220]
call fcn.0042ea61
add eax, 0xc
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x2e
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], 6
call fcn.00412ac4
lea ecx, [ebp + 0xc]
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
push eax
lea ecx, [ebp + 0xc]
call fcn.00411f3a
push 0
push 0x60cdc0
lea ecx, [ebp + 0xc]
call fcn.0042ea61
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp + 0xc]
call fcn.0043189c
push 0
mov edi, 0x60cdbc
mov byte [ebp - 4], 0x2f
push edi
lea ecx, [ebp - 0x23c]
call fcn.0042ea61
mov esi, 0x200000
test eax, eax
jne 0x47965e
push 1
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00434d0c
or ebx, esi
mov byte [ebp - 4], 0x30
push edi
mov ecx, eax
mov dword [ebp - 0x22c], ebx
call fcn.0042e677
mov byte [ebp - 0x219], 1
test eax, eax
je 0x479665
mov byte [ebp - 0x219], 0
mov dword [ebp - 4], 0x2f
test esi, ebx
je 0x47967e
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp byte [ebp - 0x219], 0
je 0x479730
push 0
push edi
lea ecx, [ebp - 0x23c]
call fcn.0042ea61
inc eax
lea ecx, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x31
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
mov byte [ebp - 4], 0x2f
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push edi
lea ecx, [ebp - 0x228]
call fcn.0042ea61
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x228]
call fcn.0043189c
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x32
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
mov byte [ebp - 4], 0x2f
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x23c]
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
push eax
lea ecx, [ebp - 0x23c]
call fcn.00411f3a
push 0
push 0x60cf34
lea ecx, [ebp - 0x23c]
call fcn.0042ea61
test eax, eax
jne 0x479868
push 0x60e7a4
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0042dfbd
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, dword [ebp - 0x228]
cmp dword [esi - 4], 1
jle 0x47979d
push dword [esi - 0xc]
lea ecx, [ebp - 0x228]
call fcn.00412624
mov esi, dword [ebp - 0x228]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push 0x12c
call ebx
push 0x60e7a4
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0042dfbd
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
cmp dword [esi - 4], 1
jle 0x4797f2
push dword [esi - 0xc]
lea ecx, [ebp - 0x228]
call fcn.00412624
mov esi, dword [ebp - 0x228]
push esi
push 0x12c
call ebx
push 1
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x228]
call fcn.0043189c
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x33
push ecx
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0043910d
add esp, 0xc
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x34
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x254]
mov byte [ebp - 4], 0x2f
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0xffffffffffffffff
lea ecx, [ebp - 0x228]
call fcn.004349e4
jmp 0x47986e
mov esi, dword [ebp - 0x228]
push 0
push 0x60ce98
lea ecx, [ebp - 0x23c]
call fcn.0042ea61
cmp eax, 0xffffffff
jne 0x4798c2
push str..dll
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0042dfbd
add esp, 0xc
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x35
call fcn.00411f3a
mov ecx, dword [ebp - 0x234]
mov byte [ebp - 4], 0x2f
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
push eax
call fcn.00412393
mov edi, dword [ebp - 0x258]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x23c]
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
jmp 0x4788d5
mov ecx, dword [ebp - 0x258]
call fcn.00413f09
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x248]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x244]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, dword [ebp - 0x258]
call fcn.00506da5
ret 8