Function at 0x416b30
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41e8e0
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x18]
call 0x416b60
pop ebx
mov edx, dword fs:[0]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [ebp - 0x138], eax
movzx eax, byte [esi + 0x2c]
mov edi, dword [esi + 0x28]
test al, al
sete cl
test edi, edi
sete dl
and dl, cl
je 0x416bb5
lea eax, [ebp - 0x144]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x98], eax
jmp 0x4174fa
test al, al
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x30], dl
mov dword [ebp - 0x118], 0
jne 0x416d65
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x419fab
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x110], eax
nop word cs:[eax + eax]
nop dword [eax + eax]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], 5
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004141b0
add esp, 8
cmp byte [ebp - 0x54c], 2
je 0x416d53
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
lea eax, [ebp - 0x548]
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x10], 7
movsd qword [ebp - 0xdc], xmm1
movsd qword [ebp - 0xe4], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xdc]
movsd qword [ebp - 0x8c], xmm1
movsd qword [ebp - 0x94], xmm0
add ecx, eax
mov dword [ebp - 0xcc], ecx
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xc8], eax
mov word [ebp - 0xc4], 0
call fcn.00408630
movsd xmm1, qword [ebp - 0x550]
movsd xmm0, qword [ebp - 0x558]
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x9d], 0
mov dword [ebp - 0x10], 6
lea edx, [ebp - 0x120]
movsd qword [ebp - 0x74], xmm1
movsd xmm1, qword [ebp - 0x108]
movsd qword [ebp - 0x7c], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x548]
movsd xmm2, qword [eax]
movsd qword [ecx], xmm1
movsd xmm1, qword [eax + 8]
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0x108]
movsd qword [ebp - 0xcc], xmm2
movsd qword [ebp - 0xc4], xmm1
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00405530
add esp, 8
cmp byte [ebp - 0xfc], 2
je 0x416c00
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x416c00
push 1
push eax
push dword [ebp - 0x104]
call fcn.00402a20
add esp, 0xc
jmp 0x416c00
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x28]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
xor edx, edx
test ecx, ecx
sete dl
cmove edi, ecx
add edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0x10], 1
nop dword [eax + eax]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 1
call fcn.00402ac0
mov dword [ebp - 0x28], edx
mov edi, eax
test eax, eax
je 0x41730f
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0xc], 2
jne 0x416f60
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x416db0
mov edx, dword [ebp - 0x120]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], edx
push dword [edi + 0x18]
push dword [edi + 0x14]
mov dword [ebp - 0x24], eax
push eax
call fcn.00407e80
add esp, 0xc
cmp dword [ebp - 0x94], 0
jne 0x416db0
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
mov byte [ebp - 0x12c], 0
test ecx, ecx
jne 0x416e67
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x74], edx
lea ecx, [ebp - 0x558]
lea edx, [ebp - 0x7c]
push eax
call fcn.004078a0
add esp, 4
jmp 0x417204
movzx edx, word [eax + 0x1ea]
mov eax, dword [eax + edx*4 + 0x1ec]
dec ecx
jne 0x416e60
movzx ecx, word [eax + 0x1ea]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x114]
dec ecx
mov dword [ebp - 0x10c], ecx
lea ecx, [ebp - 0x558]
push eax
call fcn.004078a0
add esp, 4
movsd xmm2, qword [ebp - 0x540]
movsd xmm1, qword [ebp - 0x548]
mov eax, dword [ebp - 0x530]
movsd xmm0, qword [ebp - 0x538]
mov edx, dword [ebp - 0x528]
mov ecx, dword [ebp - 0x524]
movsd qword [ebp - 0xb4], xmm2
movsd qword [ebp - 0xbc], xmm1
movsd xmm2, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov dword [ebp - 0xa4], eax
movsd qword [ebp - 0xac], xmm0
movsd qword [ebp - 0xc4], xmm1
movsd qword [ebp - 0xcc], xmm2
movzx eax, word [edx + 0x1ea]
cmp ecx, eax
mov eax, edx
jb 0x4170ea
nop word [eax + eax]
mov eax, dword [edx + 0xb0]
test eax, eax
je 0x4170e8
movzx ecx, word [edx + 0x1e8]
mov edx, eax
cmp cx, word [eax + 0x1ea]
jae 0x416f30
jmp 0x4170ea
mov esi, dword [edi + 8]
mov eax, dword [edi + 4]
test esi, esi
je 0x416f8c
mov dword [ebp - 0x24], eax
js 0x419ebc
push 1
push esi
call fcn.00402a10
add esp, 8
mov ebx, eax
test eax, eax
mov eax, dword [ebp - 0x24]
jne 0x416f91
jmp 0x419e5d
mov ebx, 1
push esi
push eax
push ebx
call fcn.0042b960
add esp, 0xc
movzx eax, byte [edi + 0xc]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
test esi, esi
je 0x416ff4
xor ebx, ebx
cmp esi, 0x40000000
setb al
jae 0x419e6d
mov bl, al
lea edx, [esi + esi]
add ebx, ebx
test edx, edx
js 0x419e7e
mov dword [ebp - 0x24], edx
je 0x416ffd
push ebx
push edx
mov edi, ecx
call fcn.00402a10
mov ecx, edi
add esp, 8
mov edi, eax
test edi, edi
jne 0x417007
jmp 0x419e8f
mov edi, 2
xor eax, eax
jmp 0x41700a
mov edi, ebx
test edi, edi
je 0x419e8f
mov eax, dword [ebp - 0x24]
push eax
push ecx
push edi
call fcn.0042b960
add esp, 0xc
movsd xmm0, qword [ebp - 0x7c]
movsd xmm1, qword [ebp - 0x74]
mov eax, dword [ebp - 0x28]
movsd qword [ebp - 0x558], xmm0
movsd qword [ebp - 0x550], xmm1
mov dword [ebp - 0x548], esi
mov dword [ebp - 0x544], edi
mov dword [ebp - 0x540], esi
mov ebx, dword [eax + 8]
mov esi, dword [eax + 4]
test ebx, ebx
je 0x41706a
js 0x419ea7
push 1
push ebx
call fcn.00402a10
add esp, 8
mov edi, eax
test eax, eax
jne 0x41706f
jmp 0x419ec6
mov edi, 1
push ebx
push esi
push edi
call fcn.0042b960
add esp, 0xc
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xcc]
lea edx, [ebp - 0x120]
movzx eax, byte [eax + 0xc]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x7d], 0
mov dword [ebp - 0x10], 2
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.00405530
add esp, 8
cmp byte [ebp - 0xc0], 2
je 0x416db0
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x416db0
push 1
push eax
push dword [ebp - 0xc8]
call fcn.00402a20
add esp, 0xc
jmp 0x416db0
mov eax, edx
lea edx, [ebp - 0xb0]
movsd xmm2, qword [ebp - 0xc4]
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
movsd qword [ebp - 0x550], xmm1
movsd qword [ebp - 0x558], xmm0
mov esi, dword [eax + edx + 0xcc]
mov dword [ebp - 0x64], esi
mov esi, dword [ebp - 0xb4]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [ebp - 0x6c], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm0
movsd xmm0, qword [ebp - 0xbc]
movsd xmm1, qword [ebp - 0xcc]
mov dword [eax + edx + 0xcc], esi
movsd qword [eax + edx + 0xbc], xmm2
movsd qword [eax + edx + 0xb4], xmm1
movsd qword [eax + edx + 0xc4], xmm0
lea edx, [ebp - 0x60]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
movsd xmm1, qword [ebp - 0x74]
mov eax, dword [ebp - 0x54]
movsd xmm0, qword [ebp - 0x7c]
movsd xmm2, qword [ebp - 0x64]
movsd qword [ebp - 0x550], xmm1
movsd xmm1, qword [ebp - 0x6c]
mov dword [ebp - 0x530], eax
movsd qword [ebp - 0x558], xmm0
movsd qword [ebp - 0x540], xmm2
movsd qword [ebp - 0x548], xmm1
movsd xmm1, qword [ebp - 0x5c]
movsd qword [ebp - 0x538], xmm1
movsd xmm2, qword [ebp - 0x540]
movsd xmm1, qword [ebp - 0x548]
mov eax, dword [ebp - 0x530]
movsd xmm0, qword [ebp - 0x538]
dec dword [ebp - 0x118]
cmp byte [ebp - 0x12c], 0
movsd qword [ebp - 0x64], xmm2
movsd qword [ebp - 0x6c], xmm1
movsd xmm2, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov dword [ebp - 0x54], eax
movsd qword [ebp - 0x5c], xmm0
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm2
je 0x417298
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x419f4f
mov ecx, dword [ebp - 0x24]
dec edx
mov eax, dword [ecx + 0x1ec]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], edx
mov dword [eax + 0xb0], 0
push 4
push 0x21c
push ecx
call fcn.00402a20
add esp, 0xc
cmp byte [ebp - 0x70], 2
je 0x416db0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x60]
movzx ebx, byte [ebp - 0x54]
test eax, eax
mov dword [ebp - 0x28], ecx
je 0x4172d9
push 1
push eax
push dword [ebp - 0x78]
mov byte [ebp - 0x24], bl
mov ebx, esi
mov esi, edx
call fcn.00402a20
mov edx, esi
mov esi, ebx
movzx ebx, byte [ebp - 0x24]
add esp, 0xc
test edi, edi
je 0x4172eb
add edi, edi
push 2
push edi
push edx
call fcn.00402a20
add esp, 0xc
cmp bl, 2
je 0x416db0
test esi, esi
je 0x416db0
push 1
push esi
push dword [ebp - 0x28]
call fcn.00402a20
add esp, 0xc
jmp 0x416da1
movsd xmm0, qword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
cmp byte [ebp - 0x30], 0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x98], eax
movsd qword [ebp - 0x144], xmm0
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x148], 1
je 0x417356
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0
jmp 0x4174fa
push 1
push 4
call fcn.00402a10
add esp, 8
test eax, eax
je 0x419f8f
mov ecx, eax
lea edx, [ebp - 0x558]
mov dword [ebp - 0x7c], 4
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 4
mov dword [eax], 0x48544150
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x19
add ecx, 4
mov dword [ebp - 0x558], ecx
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x554], eax
mov word [ebp - 0x550], 0
call fcn.00408630
movsd xmm1, qword [ebp - 0x74]
movsd xmm0, qword [ebp - 0x7c]
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x140]
movsd qword [ebp - 0x550], xmm1
movsd xmm1, qword [ebp - 0xcc]
movsd qword [ebp - 0x558], xmm0
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x30], eax
test edx, edx
movsd qword [ebp - 0x548], xmm1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x24], eax
je 0x4174b8
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], eax
movzx esi, word [edx + 0x1ea]
lea ecx, [edx + 0xb4]
lea edi, [edx - 8]
mov dword [ebp - 0x34], edx
lea eax, [esi + esi*8]
mov dword [ebp - 0x50], esi
lea ebx, [eax + eax*2]
add ebx, esi
mov esi, 0xffffffff
nop word [eax + eax]
test ebx, ebx
je 0x417474
lea eax, [ecx + 0x1c]
mov dword [ebp - 0x28], eax
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov ecx, dword [ebp - 0x28]
add ebx, 0xffffffe4
add edi, 0x10
inc esi
cmp eax, 3
je 0x417440
cmp eax, 1
jne 0x417492
jmp 0x417477
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x44]
sub eax, 1
jb 0x417dea
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov edx, dword [edx + esi*4 + 0x1ec]
jmp 0x417417
cmp eax, 2
jne 0x419ee1
cmp dword [ebp - 0x34], 0
mov esi, dword [ebp - 0x48]
je 0x4174c2
mov eax, dword [edi - 4]
mov edi, dword [edi]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x558]
test eax, eax
jne 0x4174cc
jmp 0x4174dd
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x558]
test eax, eax
je 0x4174dd
push 1
push eax
push dword [ebp - 0x554]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x34], edi
test eax, eax
je 0x4174fa
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402a20
add esp, 0xc
mov edi, dword [esi + 0x18]
test edi, edi
je 0x41754d
mov edx, dword [esi + 0x14]
mov ecx, 0x414ae0
cmp edi, 4
jb 0x417523
cmp dword [edx], 0x5c3f5c5c
mov eax, 0x414b00
mov dword [ebp - 0x10], 9
cmove ecx, eax
movzx eax, byte [edi + edx - 1]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x30], eax
push eax
call ecx
add esp, 4
mov ebx, dword [ebp - 0x28]
test al, al
je 0x4175cd
mov eax, 0x43dc50
mov dword [ebp - 0xe0], 2
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0x148], 0
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xdc]
mov dword [edx + 4], ecx
mov dword [edx], eax
mov dword [edx + 8], 2
je 0x41767c
mov ecx, dword [ebp - 0x140]
test ecx, ecx
je 0x417651
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x554], edx
mov dword [ebp - 0x550], ecx
mov dword [ebp - 0x544], edx
mov dword [ebp - 0x540], ecx
xor ecx, ecx
jmp 0x417658
mov edi, dword [ebp - 0x24]
xor eax, eax
cmp ebx, 3
mov ecx, 0
jbe 0x4176a7
movzx ecx, byte [ebx + edi - 4]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x2e
jne 0x4176a5
movzx ecx, byte [edi + ebx - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x4176a5
movzx ecx, byte [edi + ebx - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x4176a5
mov edx, dword [ebp - 0x30]
mov ecx, edx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, dl
cmp cl, 0x65
sete cl
jmp 0x4176a7
xor eax, eax
mov ecx, 2
mov dword [ebp - 0x558], ecx
mov dword [ebp - 0x548], ecx
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x10], 0
call fcn.00403c40
cmp dword [ebp - 0x138], 3
jb 0x417691
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x54c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
lea edx, [edi + ebx]
mov dword [ebp - 0x30], edx
nop dword [eax]
cmp ebx, eax
je 0x4176ec
movzx edx, byte [edi + eax]
cmp edx, 0x2f
je 0x4176c3
inc eax
cmp edx, 0x5c
jne 0x4176b0
test cl, cl
je 0x4177b4
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0xe4]
mov edx, edi
push ebx
call fcn.00413540
add esp, 4
jmp 0x417e5a
xor esi, esi
mov eax, edi
jmp 0x41770b
xor esi, esi
test dx, dx
je 0x4178a0
mov dx, 1
test si, si
jne 0x417700
cmp eax, dword [ebp - 0x30]
je 0x4178ea
movzx ebx, byte [eax]
movzx ecx, bl
test bl, bl
js 0x41772d
mov ebx, dword [ebp - 0x28]
inc eax
jmp 0x417782
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp bl, 0xdf
jbe 0x417774
movzx esi, byte [eax + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp bl, 0xf0
jb 0x41778b
movzx edi, byte [eax + 3]
and ecx, 7
shl esi, 6
add eax, 4
shl ecx, 0x12
and edi, 0x3f
or edi, esi
or ecx, edi
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0xffff
jbe 0x417782
jmp 0x4177a1
shl ecx, 6
mov ebx, dword [ebp - 0x28]
add eax, 2
or ecx, edi
mov edi, dword [ebp - 0x24]
xor esi, esi
mov edx, ecx
jmp 0x417702
shl ecx, 0xc
add eax, 3
or ecx, esi
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0xffff
jbe 0x417782
and ecx, 0x3ff
or ecx, 0xdc00
mov esi, ecx
jmp 0x417702
xor ecx, ecx
test ebx, ebx
setns al
js 0x41a042
mov cl, al
mov dword [ebp - 0x2c], ecx
push ecx
push ebx
call fcn.00402a10
add esp, 8
test eax, eax
je 0x41a057
mov esi, eax
push ebx
push edi
push eax
call fcn.0042b960
add esp, 0xc
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x10], 0x18
lea eax, [ebp - 0x558]
movsd xmm0, qword [ebp - 0x74]
movsd xmm1, qword [ebp - 0x7c]
movsd qword [ebp - 0x550], xmm0
movsd qword [ebp - 0x558], xmm1
push 4
push str..exeprogram_not_found
push eax
call fcn.00414870
add esp, 0xc
movsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x550]
mov byte [ebp - 0x9e], 1
mov dword [ebp - 0x10], 0x17
lea ecx, [ebp - 0x558]
movsd qword [ebp - 0x74], xmm1
movsd qword [ebp - 0x7c], xmm0
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
push eax
call fcn.0041a910
add esp, 4
cmp dword [ebp - 0x554], 0
je 0x4178b4
mov eax, dword [ebp - 0x550]
movsd xmm0, qword [ebp - 0x558]
mov dword [ebp - 0xd8], eax
movsd qword [ebp - 0xe0], xmm0
mov dword [ebp - 0xe4], 0
jmp 0x417e45
mov dword [ebp - 0xe0], 2
mov eax, 0x43dc24
jmp 0x41755c
mov dword [ebp - 0x10], 0x16
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call fcn.0040e4e0
add esp, 8
test eax, eax
je 0x417d40
cmp edx, 2
jne 0x417915
movzx ecx, word [eax]
cmp ecx, 0x2e2e
jne 0x417915
mov edi, 2
xor ecx, ecx
jmp 0x417959
cmp ebx, 7
ja 0x41795e
mov esi, dword [ebp - 0x34]
lea eax, [ebx - 1]
nop word cs:[eax + eax]
nop
sub eax, 1
setb dl
cmp byte [edi], 0x2e
sete dh
je 0x41797e
inc edi
test dl, dl
je 0x417900
jmp 0x41797e
xor ebx, ebx
mov edi, eax
nop dword [eax]
cmp edx, ebx
je 0x417e00
cmp byte [edi + edx - 1], 0x2e
lea ecx, [edi - 1]
mov esi, ebx
lea ebx, [ebx + 1]
mov edi, ecx
jne 0x417920
mov edi, edx
sub edi, ebx
mov dword [ebp - 0x44], edi
inc edi
mov dword [ebp - 0x34], edi
cmp edx, dword [ebp - 0x34]
jb 0x41a0a7
cmp edx, ebx
jne 0x4180a2
xor ecx, ecx
mov edi, edx
jmp 0x417e06
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push ebx
push edi
push 0x2e
call fcn.00428430
add esp, 0xc
mov esi, dword [ebp - 0x34]
cmp eax, 1
sete dh
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x84], dh
mov dword [ebp - 0x10], 9
test eax, eax
je 0x417add
add esi, eax
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x558]
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov word [ebp - 0xc4], 0
mov byte [ebp - 0xc0], 1
push eax
push ecx
call fcn.004143a0
add esp, 8
jmp 0x4179ea
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004143a0
add esp, 8
movzx eax, byte [ebp - 0x54c]
cmp al, 2
je 0x417add
mov esi, dword [ebp - 0x550]
mov edx, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x554]
test esi, esi
jne 0x417a21
test edx, edx
je 0x4179d0
push 1
push edx
push ecx
call fcn.00402a20
add esp, 0xc
jmp 0x4179d0
lea edi, [ebp - 0x54b]
lea ebx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0x15
movzx edi, word [edi]
mov word [ebx], di
lea edi, [ebp - 0x54b]
mov ah, byte [edi + 2]
mov byte [ebx + 2], ah
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040d420
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x417a7d
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e000
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x74]
call fcn.0041a910
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x417aa9
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00402a20
add esp, 0xc
mov edi, dword [ebp - 0x554]
test edi, edi
jne 0x41935f
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004143a0
add esp, 8
jmp 0x4179ea
lea ecx, [ebp - 0xcc]
mov byte [ebp - 0x1d], 1
call fcn.00414660
cmp byte [ebp - 0xc0], 2
jne 0x417b4a
cmp byte [ebp - 0xcc], 3
jne 0x417c38
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ecx]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 0x12
push eax
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x417b38
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00402a20
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00402a20
add esp, 0xc
jmp 0x417c38
movsd xmm0, qword [ebp - 0xcc]
movsd xmm1, qword [ebp - 0xc4]
mov byte [ebp - 0x9f], 1
mov dword [ebp - 0x10], 0x13
movsd qword [ebp - 0x7c], xmm0
movsd qword [ebp - 0x74], xmm1
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c], ecx
push ecx
push eax
call fcn.0040e3a0
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
je 0x417b97
cmp dword [ebp - 0x2c], edx
jb 0x417b97
mov dword [ebp - 0x74], edx
movsd xmm0, qword [ebp - 0x7c]
movsd xmm1, qword [ebp - 0x74]
mov dword [ebp - 0x10], 0x14
lea edx, [ebp - 0x558]
movsd qword [ebp - 0x550], xmm1
movsd qword [ebp - 0x558], xmm0
push ecx
push eax
push edx
call fcn.0040d420
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x417be8
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x558]
push eax
call fcn.0040e000
add esp, 0xc
mov edx, dword [ebp - 0x554]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x550]
call fcn.0041a910
add esp, 4
mov eax, dword [ebp - 0x558]
test eax, eax
je 0x417c1d
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00402a20
add esp, 0xc
mov edi, dword [ebp - 0x104]
test edi, edi
je 0x417c38
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x100]
jmp 0x418137
mov esi, 0x200
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 2
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jb 0x417c8e
jmp 0x417ca0
jbe 0x417d48
cmp esi, 0x201
jae 0x417ca0
lea ebx, [ebp - 0x558]
mov dword [ebp - 0x44], 0x200
mov edi, esi
jmp 0x417ce7
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x417cd5
mov dword [ebp - 0x10], 0x10
lea ecx, [ebp - 0x108]
mov edx, edi
push esi
call fcn.00439160
add esp, 4
mov edi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x417d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x417e6c
cmp esi, edi
jne 0x417c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x419f6f
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x417ca0
jmp 0x417c8e
mov ebx, dword [ebp - 0x2c]
jmp 0x417e2c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], 0x10
cmp esi, eax
ja 0x41a093
lea eax, [ebp - 0x7c]
push esi
push ebx
push eax
call fcn.0040bf40
add esp, 0xc
mov dword [ebp - 0x10], 0x11
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040d420
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x417d9d
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e000
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x74]
call fcn.0041a910
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x417dc9
push 1
push eax
push dword [ebp - 0x34]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov al, 1
mov dword [ebp - 0x44], eax
jmp 0x417e7f
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x558]
test eax, eax
jne 0x4174cc
jmp 0x4174dd
mov ecx, eax
xor eax, eax
mov esi, edx
mov ebx, dword [ebp - 0x2c]
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x417e2c
test eax, eax
cmove edi, esi
add ecx, edi
sub ecx, dword [ebp - 0x28]
cmp ebx, ecx
jb 0x417e2c
mov ebx, ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x10], 0x16
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0x16
lea ecx, [ebp - 0xe4]
push ebx
call fcn.00413540
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x417e5a
push 1
push eax
push dword [ebp - 0x28]
call fcn.00402a20
add esp, 0xc
cmp dword [ebp - 0xe4], 0
jne 0x417562
jmp 0x418149
mov dword [ebp - 0x44], 0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x417e9a
add eax, eax
push 2
push eax
push dword [ebp - 0x50]
mov esi, ecx
call fcn.00402a20
mov ecx, esi
add esp, 0xc
test edi, edi
sete al
or bl, al
cmp bl, 1
jne 0x41812c
cmp byte [ebp - 0x44], 0
je 0x417ec0
test edi, edi
je 0x417f02
test ecx, ecx
je 0x417f02
add ecx, ecx
push 2
push ecx
push edi
jmp 0x417efa
cmp cl, 3
jne 0x417f02
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], 0xf
push eax
mov dword [ebp - 0x2c], edi
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x417ef5
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00402a20
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00402a20
add esp, 0xc
mov esi, 0x200
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 2
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jb 0x417f52
jmp 0x417f63
jbe 0x418003
cmp esi, 0x201
jae 0x417f63
lea ebx, [ebp - 0x558]
mov dword [ebp - 0x44], 0x200
mov edi, esi
jmp 0x417faa
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x417f98
mov dword [ebp - 0x10], 0xd
lea ecx, [ebp - 0x108]
mov edx, edi
push esi
call fcn.00439160
add esp, 4
mov edi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
test eax, eax
jne 0x417fce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4180be
cmp esi, edi
jne 0x417f44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41a022
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jae 0x417f63
jmp 0x417f52
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], 0xd
cmp esi, eax
ja 0x41a0c1
lea eax, [ebp - 0x7c]
push esi
push ebx
push eax
call fcn.0040bf40
add esp, 0xc
mov dword [ebp - 0x10], 0xe
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040d420
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x418058
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e000
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x74]
call fcn.0041a910
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x418084
push 1
push eax
push dword [ebp - 0x34]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
mov edi, dword [ebp - 0xc8]
xor ebx, ebx
mov dword [ebp - 0x34], eax
mov al, 1
mov dword [ebp - 0x44], eax
jmp 0x4180d1
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x44]
lea ecx, [ecx + edx + 1]
test eax, eax
cmovne ecx, eax
test ecx, ecx
jne 0x417e12
jmp 0x417e2c
mov dword [ebp - 0x44], 0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4180ec
add eax, eax
push 2
push eax
push dword [ebp - 0x50]
mov esi, ecx
call fcn.00402a20
mov ecx, esi
add esp, 0xc
test edi, edi
sete al
or bl, al
cmp bl, 1
jne 0x41812c
cmp byte [ebp - 0x44], 0
je 0x41906e
test edi, edi
je 0x4190b0
test ecx, ecx
je 0x4190b0
add ecx, ecx
push 2
push ecx
push edi
call fcn.00402a20
add esp, 0xc
mov dword [ebp - 0x10], 9
jmp 0x4190b0
mov eax, dword [ebp - 0x34]
test edi, edi
je 0x419250
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xdc]
cmp ecx, 5
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x124], ecx
jb 0x418186
cmp word [eax + ecx*2 - 0xa], 0x2e
jne 0x418186
cmp word [eax + ecx*2 - 2], 0
je 0x4189a3
mov dword [ebp - 0x10], 0x1b
mov eax, dword [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 2
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x10], 0x1b
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x54]
movzx eax, byte [eax + 0x59]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x2c], al
call fcn.00408350
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x30]
mov word [eax + ecx*2], 0x22
inc ecx
mov dword [ebp - 0x558], edx
lea edx, [ebp - 0x558]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x554], ecx
lea ecx, [ebp - 0x7c]
mov word [ebp - 0x550], 0
call fcn.00408500
mov edx, dword [ebp - 0x74]
cmp edx, dword [ebp - 0x7c]
jne 0x418215
lea ecx, [ebp - 0x7c]
call fcn.00408350
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
mov esi, dword [ebp - 0x28]
movzx ecx, byte [ebp - 0x2c]
mov word [eax + edx*2], 0x22
mov eax, dword [ebp - 0x3c]
inc edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x74], edx
lea eax, [eax + eax*4]
lea eax, [esi + eax*4]
mov dword [ebp - 0x24], eax
cmp esi, dword [ebp - 0x24]
je 0x418296
nop dword [eax]
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x28], esi
cmp edx, dword [ebp - 0x7c]
jne 0x418259
lea ecx, [ebp - 0x7c]
call fcn.00408350
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0xcc]
mov word [eax + edx*2], 0x20
inc edx
mov dword [ebp - 0x74], edx
lea edx, [ebp - 0x7c]
push dword [ebp - 0x30]
push esi
call fcn.004130b0
add esp, 8
movzx ebx, byte [ebp - 0xcc]
cmp bl, 4
jne 0x41839f
mov esi, dword [ebp - 0x28]
add esi, 0x14
cmp esi, dword [ebp - 0x24]
jne 0x418240
movsd xmm0, qword [ebp - 0x12c]
mov esi, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
mov bl, 1
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x2c], ebx
movsd qword [ebp - 0x94], xmm0
mov dword [ebp - 0x8c], esi
mov esi, dword [ebp - 0x8c]
movsd xmm0, qword [ebp - 0x94]
cmp edx, ecx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x118], esi
movsd qword [ebp - 0x120], xmm0
jne 0x41831e
lea ecx, [ebp - 0x114]
mov byte [ebp - 0x3d], 1
mov dword [ebp - 0x10], 0x1e
call fcn.00408350
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x48]
mov word [eax + edx*2], 0
inc edx
mov eax, 0x400
mov ecx, 0x608
mov dword [ebp - 0x10c], edx
cmp byte [esi + 0x58], 0
cmove ecx, eax
or ecx, dword [esi + 0x48]
cmp dword [ebp - 0x148], 0
mov dword [ebp - 0x44], ecx
je 0x4183f4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 2
mov dword [ebp - 0x8c], 0
mov esi, dword [eax + 8]
movsd xmm0, qword [eax]
test esi, esi
mov dword [ebp - 0xdc], esi
movsd qword [ebp - 0xe4], xmm0
je 0x418441
xor ecx, ecx
mov eax, 2
jmp 0x418478
movzx eax, byte [ebp - 0xc5]
movzx esi, word [ebp - 0xc7]
mov edi, dword [ebp - 0xcb]
shl eax, 0x10
or esi, eax
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4183cf
add eax, eax
push 2
push eax
push dword [ebp - 0x78]
call fcn.00402a20
add esp, 0xc
mov ecx, dword [ebp - 0x9c]
shld esi, edi, 8
shl edi, 8
movzx eax, bl
or eax, edi
mov dword [ecx + 4], esi
mov dword [ecx], eax
mov dword [ecx + 8], 2
xor ebx, ebx
jmp 0x4194c0
xor edx, edx
mov eax, 2
mov dword [ebp - 0x30], 0
xor ecx, ecx
cmp byte [esi + 0xc], 2
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xdc], edx
jne 0x4188f5
xor edx, edx
mov ecx, 2
xor eax, eax
mov dword [ebp - 0x14c], 0
jmp 0x418bf3
lea ecx, [ebp - 0x94]
xor edx, edx
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x3e], 1
mov dword [ebp - 0x10], 0x1f
call fcn.00408350
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x28]
mov word [eax + ecx*2], 0
inc ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0xd0], ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xe4]
xor edx, edx
mov dword [ebp - 0x10], 0x20
test ecx, ecx
sete dl
cmove esi, ecx
add edx, edx
mov dword [ebp - 0x558], edx
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], ecx
mov dword [ebp - 0x548], edx
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], ecx
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov dword [ebp - 0x538], esi
call fcn.004069c0
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x419264
mov eax, dword [ebp - 0x74]
lea edx, [eax + eax*8]
lea edx, [edx + edx*2]
add edx, eax
cmp byte [ecx + edx + 0xc0], 2
je 0x419264
mov esi, dword [ecx + edx + 0xb4]
mov edi, dword [ecx + edx + 0xbc]
shl eax, 4
mov ebx, dword [ecx + edx + 0xc8]
movsd xmm0, qword [ecx + eax]
movsd xmm1, qword [ecx + eax + 8]
mov eax, dword [ecx + edx + 0xc4]
mov dword [ebp - 0x34], esi
mov esi, dword [ecx + edx + 0xb8]
mov edx, dword [ecx + edx + 0xcc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x98], eax
movsd qword [ebp - 0xc4], xmm1
movsd qword [ebp - 0xcc], xmm0
add edi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edi
xor edi, edi
jmp 0x41856b
xor edi, edi
test bx, bx
je 0x418893
mov bx, 1
test di, di
jne 0x418560
cmp esi, dword [ebp - 0x28]
je 0x418603
movzx eax, byte [esi]
movzx ecx, al
test al, al
js 0x41858a
inc esi
jmp 0x4185d7
movzx edx, byte [esi + 1]
and ecx, 0x1f
and edx, 0x3f
cmp al, 0xdf
jbe 0x4185cc
movzx edi, byte [esi + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp al, 0xf0
jb 0x4185dd
movzx eax, byte [esi + 3]
and ecx, 7
shl edi, 6
add esi, 4
shl ecx, 0x12
and eax, 0x3f
or eax, edi
or ecx, eax
mov edx, dword [ebp - 0x24]
cmp ecx, 0xffff
jbe 0x4185d7
jmp 0x4185f0
shl ecx, 6
add esi, 2
or ecx, edx
mov edx, dword [ebp - 0x24]
xor edi, edi
mov ebx, ecx
jmp 0x418562
shl ecx, 0xc
add esi, 3
or ecx, edi
mov edx, dword [ebp - 0x24]
cmp ecx, 0xffff
jbe 0x4185d7
and ecx, 0x3ff
or ecx, 0xdc00
mov edi, ecx
jmp 0x418562
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41861b
push 1
push eax
push dword [ebp - 0x50]
call fcn.00402a20
mov edx, dword [ebp - 0x24]
add esp, 0xc
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x98]
mov edi, dword [ebp - 0xd0]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x94]
lea eax, [ebx + edx*2]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], eax
sub ecx, edi
cmp ecx, edx
mov ecx, dword [ebp - 0x30]
jae 0x418674
mov eax, edx
mov dword [ebp - 0x10], 0x23
lea ecx, [ebp - 0x94]
mov edx, edi
push eax
call fcn.00439160
add esp, 4
mov ecx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
lea eax, [edx + edx]
mov dword [ebp - 0x30], ecx
lea ecx, [ecx + edi*2]
push eax
push ebx
push ecx
mov esi, edx
call fcn.0042b960
add esp, 0xc
mov eax, dword [ebp - 0x98]
add edi, esi
mov dword [ebp - 0x8c], edi
test eax, eax
je 0x4186aa
add eax, eax
push 2
push eax
push ebx
call fcn.00402a20
add esp, 0xc
cmp edi, dword [ebp - 0x94]
jne 0x4186d8
lea ecx, [ebp - 0x94]
mov edx, edi
mov byte [ebp - 0x49], 1
mov dword [ebp - 0x10], 0x21
call fcn.00408350
mov eax, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
jmp 0x4186db
mov eax, dword [ebp - 0x30]
mov word [eax + edi*2], 0x3d
inc edi
mov esi, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
movzx edx, byte [ebp - 0xc0]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x8c], edi
xor edi, edi
mov byte [ebp - 0x98], dl
lea edx, [esi + ecx]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], edx
jmp 0x418725
xor edi, edi
test bx, bx
je 0x418b17
mov bx, 1
test di, di
jne 0x41871a
cmp esi, edx
je 0x4187b1
movzx ecx, byte [esi]
movzx eax, cl
test cl, cl
js 0x41873f
inc esi
jmp 0x418797
movzx edx, byte [esi + 1]
and eax, 0x1f
and edx, 0x3f
cmp cl, 0xdf
jbe 0x418778
movzx edi, byte [esi + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp cl, 0xf0
jb 0x418785
movzx ecx, byte [esi + 3]
and eax, 7
shl edi, 6
add esi, 4
shl eax, 0x12
and ecx, 0x3f
or ecx, edi
or eax, ecx
jmp 0x41878d
shl eax, 6
add esi, 2
or eax, edx
mov edx, dword [ebp - 0x28]
jmp 0x418797
shl eax, 0xc
add esi, 3
or eax, edi
mov edx, dword [ebp - 0x28]
cmp eax, 0xffff
ja 0x4187a0
xor edi, edi
mov ebx, eax
jmp 0x41871c
and eax, 0x3ff
or eax, 0xdc00
mov edi, eax
jmp 0x41871c
movzx ebx, byte [ebp - 0x98]
cmp bl, 2
je 0x419912
lea ecx, [ebp - 0xbf]
lea edx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0x22
movzx eax, word [ecx]
mov word [edx], ax
movzx eax, byte [ecx + 2]
mov ecx, dword [ebp - 0x24]
mov byte [edx + 2], al
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x108]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x70], bl
mov dword [ebp - 0x108], ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x104], eax
mov word [ebp - 0x100], 0
call fcn.00408500
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418831
push 1
push eax
push dword [ebp - 0x30]
call fcn.00402a20
add esp, 0xc
mov esi, dword [ebp - 0x8c]
cmp esi, dword [ebp - 0x94]
jne 0x41885d
lea ecx, [ebp - 0x94]
mov edx, esi
mov byte [ebp - 0x49], 0
mov dword [ebp - 0x10], 0x21
call fcn.00408350
mov esi, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov word [eax + esi*2], 0
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x8c], esi
call fcn.004069c0
jmp 0x4184d8
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4188a8
push 1
push eax
push dword [ebp - 0x50]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x4188c3
push 1
push eax
push dword [ebp - 0xc8]
call fcn.00402a20
add esp, 0xc
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0x43dc24
test ecx, ecx
je 0x418aef
mov dword [ebp - 0x30], 2
add ecx, ecx
push 2
push ecx
push eax
call fcn.00402a20
add esp, 0xc
jmp 0x418b3b
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
xor ebx, ebx
add ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], ecx
jmp 0x418912
xor ebx, ebx
test di, di
je 0x418af8
mov di, 1
test bx, bx
jne 0x418907
cmp edx, ecx
je 0x418b92
movzx eax, byte [edx]
movzx esi, al
test al, al
js 0x418930
inc edx
jmp 0x418987
movzx ecx, byte [edx + 1]
and esi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x418967
movzx ebx, byte [edx + 2]
shl ecx, 6
and ebx, 0x3f
or ebx, ecx
cmp al, 0xf0
jb 0x418974
movzx eax, byte [edx + 3]
and esi, 7
shl ebx, 6
add edx, 4
shl esi, 0x12
and eax, 0x3f
or eax, ebx
or esi, eax
jmp 0x41897c
shl esi, 6
add edx, 2
or esi, ecx
mov ecx, dword [ebp - 0x24]
jmp 0x418987
shl esi, 0xc
add edx, 3
or esi, ebx
mov ecx, dword [ebp - 0x24]
cmp esi, 0xffff
ja 0x418990
xor ebx, ebx
mov edi, esi
jmp 0x418909
and esi, 0x3ff
or esi, 0xdc00
mov ebx, esi
jmp 0x418909
movzx edx, word [eax + ecx*2 - 8]
lea esi, [edx - 0x42]
cmp esi, 0x21
ja 0x418186
mov edi, dword [ebp - 0x3c]
add edi, dword [esi*4 + 0x41a888]
jmp edi
mov dword [ebp - 0x30], 2
jmp 0x418b42
mov eax, dword [ebp - 0x9c]
mov dword [eax], 2
mov dword [eax + 4], 0x43dc24
mov dword [eax + 8], 2
jmp 0x41945f
mov eax, dword [ebp - 0x24]
mov esi, 2
mov dword [ebp - 0x28], 0x43dc24
test eax, eax
je 0x418b38
push 1
push eax
push dword [ebp - 0x30]
call fcn.00402a20
add esp, 0xc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], 0x1f
lea ecx, [ebp - 0x558]
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0x10], 0x1f
call fcn.00403c40
mov eax, dword [ebp - 0x94]
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x418b78
add eax, eax
push 2
push eax
push dword [ebp - 0x90]
call fcn.00402a20
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x41947a
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x558], ecx
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x558]
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0x554], eax
mov word [ebp - 0x550], 0
call fcn.00408630
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x74]
cmp edx, eax
jne 0x418bde
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x10], 0x25
call fcn.00408350
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x48]
mov word [ecx + edx*2], 0
inc edx
mov edi, ecx
mov dword [ebp - 0x14c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x8c], edx
movups xmmword [ebp - 0xcc], xmm0
push 0x449a20
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x4499f8]
test eax, 0x7fffffff
je 0x418c42
mov dword [ebp - 0x10], 0x26
call fcn.00439500
mov esi, dword [ebp - 0x48]
xor al, 1
jmp 0x418c44
xor eax, eax
movzx ecx, byte [0x449a24]
test cl, cl
mov byte [ebp - 0x34], cl
je 0x418c6a
mov ecx, 1
mov dword [ebp - 0x104], 0x449a20
mov dword [ebp - 0x10], 0x27
jmp 0x418c7d
mov dword [ebp - 0x104], 0x449a20
mov dword [ebp - 0x10], 0x27
xor ecx, ecx
mov byte [ebp - 0x100], al
mov dword [ebp - 0x3c], eax
lea eax, [esi + 0x30]
mov ebx, esi
mov esi, dword [esi + 0x30]
mov dword [ebp - 0x108], ecx
xor ecx, ecx
mov edi, dword [ebp - 0x138]
mov edx, 1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x158], 1
cmp esi, 5
mov dword [ebp - 0x50], edi
cmove eax, ecx
cmp byte [ebp + 0xc], 0
lea ecx, [ebp - 0x134]
cmovne edx, edi
lea edi, [ebp - 0x154]
cmovne edi, ecx
mov ecx, dword [ebx + 0x38]
add eax, 4
cmp esi, 5
cmovne edx, esi
cmove eax, edi
mov esi, 0
mov dword [ebp - 0x130], ecx
cmp ecx, 5
lea ecx, [ebx + 0x38]
cmove ecx, esi
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebx + 0x40]
add ebx, 0x40
cmp ecx, 5
mov dword [ebp - 0x150], ecx
lea ecx, [ebp - 0x558]
cmove ebx, esi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x48], ebx
push esi
push 0xfffffffffffffff6
push dword [eax]
call fcn.0041aa30
add esp, 0xc
movzx eax, byte [ebp - 0x558]
cmp al, 4
jne 0x419004
mov esi, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x554]
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x74]
add esi, 4
cmp edx, 5
mov dword [ebp - 0xd4], ecx
lea ecx, [ebp - 0x134]
cmove esi, ecx
cmove edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x558]
mov esi, dword [esi]
mov dword [ebp - 0x10], 0x28
push eax
push 0xfffffffffffffff5
push esi
call fcn.0041aa30
add esp, 0xc
movzx eax, byte [ebp - 0x558]
mov ecx, dword [ebp - 0x48]
cmp al, 4
jne 0x419036
mov edi, dword [ebp - 0x150]
add ecx, 4
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x6c]
cmp edi, 5
cmove ecx, edx
mov edx, dword [ebp - 0x554]
cmove edi, dword [ebp - 0x50]
mov esi, dword [ecx]
mov dword [ebp - 0x10], 0x29
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x48], edx
mov edx, edi
push eax
push 0xfffffffffffffff4
push esi
call fcn.0041aa30
add esp, 0xc
movzx eax, byte [ebp - 0x558]
cmp al, 4
jne 0x41931a
mov ebx, dword [ebp - 0xd4]
mov esi, dword [ebp - 0x554]
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x558], 0x44
test ebx, ebx
jne 0x418eb2
cmp dword [ebp - 0x48], 0
jne 0x418eb2
test esi, esi
je 0x418ed1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x52c], 0x100
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], esi
mov edi, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x558]
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x30]
push dword [ebp - 0x44]
push 1
push 0
push 0
mov dword [ebp - 0x30], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x419384
mov eax, dword [ebp - 0x9c]
movsd xmm1, qword [ebp - 0x74]
movsd xmm0, qword [ebp - 0x6c]
movsd xmm2, qword [ebp - 0x7c]
mov dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [ebp - 0xcc]
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
push esi
call edi
push dword [ebp - 0x48]
call edi
push ebx
call edi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 0x26
call fcn.00403e20
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418f80
add eax, eax
push 2
push eax
push dword [ebp - 0xd0]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x418f9d
add eax, eax
push 2
push eax
push dword [ebp - 0x98]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x418fb7
add eax, eax
push 2
push eax
push dword [ebp - 0x30]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x418fcf
add eax, eax
push 2
push eax
push esi
call fcn.00402a20
add esp, 0xc
cmp byte [ebp - 0x84], 0
je 0x418ff5
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x418ff5
add eax, eax
push 2
push eax
push dword [ebp - 0x128]
call fcn.00402a20
add esp, 0xc
cmp dword [ebp - 0x50], 3
jae 0x417685
jmp 0x417691
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x4193be
mov ebx, dword [ebp - 0xd4]
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x4193b7
cmp cl, 3
jne 0x4190b0
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], 0xc
push eax
mov dword [ebp - 0x2c], edi
call dword [ecx]
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4190a3
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.00402a20
add esp, 0xc
push 4
push 0xc
push esi
call fcn.00402a20
add esp, 0xc
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
lea eax, [ebp - 0x94]
push 4
push str.PATHlibrary_std_src_sys_commonprocess.rs
push eax
call fcn.004097d0
add esp, 0xc
cmp byte [ebp - 0x88], 2
je 0x419250
movsd xmm0, qword [ebp - 0x94]
movsd xmm1, qword [ebp - 0x8c]
movsd qword [ebp - 0x108], xmm0
movsd qword [ebp - 0x100], xmm1
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x100]
add eax, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], ecx
mov word [ebp - 0xc4], 0
mov byte [ebp - 0xc0], 1
jmp 0x41913b
mov edi, dword [ebp - 0x554]
test edi, edi
jne 0x41987c
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x10], 0xa
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004143a0
add esp, 8
jmp 0x419170
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x558]
push eax
call fcn.004143a0
add esp, 8
movzx eax, byte [ebp - 0x54c]
cmp al, 2
je 0x419238
mov esi, dword [ebp - 0x550]
mov edx, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x554]
test esi, esi
jne 0x4191a7
test edx, edx
je 0x41915a
push 1
push edx
push ecx
call fcn.00402a20
add esp, 0xc
jmp 0x41915a
lea edi, [ebp - 0x54b]
lea ebx, [ebp - 0x6f]
mov dword [ebp - 0x10], 0xb
movzx edi, word [edi]
mov word [ebx], di
lea edi, [ebp - 0x54b]
mov ah, byte [edi + 2]
mov byte [ebx + 2], ah
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], al
push dword [ebp - 0x28]
push dword [ebp - 0x24]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040d420
add esp, 0xc
cmp byte [ebp - 0x84], 0
jne 0x419203
push 3
push str.exeNULcmd.exefallback_RNG_broken:
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e000
add esp, 0xc
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x74]
call fcn.0041a910
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41912d
push 1
push eax
push dword [ebp - 0x2c]
call fcn.00402a20
add esp, 0xc
jmp 0x41912d
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x419250
push 1
push eax
push dword [ebp - 0x34]
call fcn.00402a20
add esp, 0xc
mov dword [ebp - 0xe0], 2
mov eax, 0x43dc74
jmp 0x41755c
lea ecx, [ebp - 0x558]
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0x10], 0x1f
call fcn.00403c40
mov edx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x94]
jne 0x4192a6
lea ecx, [ebp - 0x94]
mov byte [ebp - 0x3e], 0
call fcn.00408350
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov word [eax + edx*2], 0
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
test eax, eax
je 0x419370
inc edx
jmp 0x418404
mov ebx, dword [ebp - 0xd4]
movzx ecx, byte [ebp - 0x555]
mov edx, dword [ebp - 0x9c]
movzx edi, word [ebp - 0x557]
mov esi, dword [ebp - 0x554]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x4193ae
mov ecx, dword [ebp - 0x558]
mov eax, dword [ebp - 0x550]
jmp 0x418137
mov esi, dword [ebp - 0x30]
jmp 0x418b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x9c]
mov byte [ecx], 0
mov byte [ecx + 3], 0
mov word [ecx + 1], 0
mov dword [ecx + 4], eax
mov dword [ecx + 8], 2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c], 0
je 0x4193cd
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], 0
je 0x4193dc
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], 0
je 0x4193eb
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x34], 0
je 0x419411
cmp byte [ebp - 0x3c], 0
jne 0x41943a
mov eax, dword [0x4499f8]
test eax, 0x7fffffff
je 0x41943a
mov dword [ebp - 0x10], 0x26
call fcn.00439500
jmp 0x41942f
cmp byte [ebp - 0x3c], 0
jne 0x41943a
mov eax, dword [0x4499f8]
test eax, 0x7fffffff
je 0x41943a
mov dword [ebp - 0x10], 0x26
call fcn.00439500
test al, al
jne 0x41943a
mov byte [0x449a24], 1
push 0x449a20
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41945f
add eax, eax
push 2
push eax
push dword [ebp - 0xd0]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x98]
test eax, eax
je 0x41947a
add eax, eax
push 2
push eax
push ecx
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x419497
add eax, eax
push 2
push eax
push dword [ebp - 0x110]
call fcn.00402a20
add esp, 0xc
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x4194b4
add eax, eax
push 2
push eax
push dword [ebp - 0x11c]
call fcn.00402a20
add esp, 0xc
cmp byte [ebp - 0x2c], 0
mov bl, 1
jne 0x41767c
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x4194dd
add eax, eax
push 2
push eax
push dword [ebp - 0x128]
call fcn.00402a20
add esp, 0xc
cmp dword [ebp - 0x148], 0
sete al
or bl, al
je 0x41758d
jmp 0x41767c
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x558]
mov ebx, dword [ebp - 0x550]
test eax, eax
je 0x4198a4
push 1
push eax
push dword [ebp - 0x34]
mov esi, ecx
call fcn.00402a20
mov ecx, esi
add esp, 0xc
mov eax, ebx
jmp 0x418137
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jmp 0x418b38
push 1
push esi
call fcn.00439c90
add esp, 8
jmp 0x41a131
mov dword [ebp - 0x10], 4
call fcn.00425830
jmp 0x41a131
mov dword [ebp - 0x10], 4
call fcn.00425830
jmp 0x41a131
mov dword [ebp - 0x10], 4
push ebx
push dword [ebp - 0x24]
call fcn.00439c90
add esp, 8
jmp 0x41a131
mov byte [ebp - 0x7d], 1
mov dword [ebp - 0x10], 2
call fcn.00425830
jmp 0x41a131
call fcn.00425830
jmp 0x41a131
mov byte [ebp - 0x7d], 1
mov dword [ebp - 0x10], 2
push 1
push ebx
call fcn.00439c90
add esp, 8
jmp 0x41a131
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x74], 0x43dbc4
mov dword [ebp - 0x70], 1
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x10], 0x2e
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x104], 0x40a020
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 1
push 0x43dbf4
lea eax, [ebp - 0x7c]
push eax
call fcn.00439d10
add esp, 8
jmp 0x41a131
mov dword [ebp - 0x10], 3
push 0x43be78
push 0x21
push str.assertion_failed:_self.height___0
call fcn.00439dd0
add esp, 0xc
jmp 0x41a131
mov dword [ebp - 0x10], 0x10
push 0x43e0a4
push 0x28
push str.internal_error:_entered_unreachable_codeH
call fcn.00439dd0
add esp, 0xc
jmp 0x41a131
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push 1
push 4
call fcn.00439c90
add esp, 8
jmp 0x41a131
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x550], 0x43da64
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xc8], 0x40a020
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], 1
lea eax, [ebp - 0x558]
push 0x43da6c
push eax
call fcn.00439d10
add esp, 8
jmp 0x41a131
mov dword [ebp - 0x10], 0xd
push 0x43e0a4
push 0x28
push str.internal_error:_entered_unreachable_codeH
call fcn.00439dd0
add esp, 0xc
jmp 0x41a131
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
call fcn.00425830
jmp 0x41a131
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 9
push dword [ebp - 0x2c]
push ebx
call fcn.00439c90
add esp, 8
jmp 0x41a131
push 0x43e0b4
push eax
push esi
call fcn.0043a110
add esp, 0xc
jmp 0x41a131
mov dword [ebp - 0x10], 0x16
push 0x43b9ec
push edx
push dword [ebp - 0x34]
call fcn.0043a0f0
add esp, 0xc
jmp 0x41a131
push 0x43e0b4
push eax
push esi
call fcn.0043a110
add esp, 0xc
jmp 0x41a131
ud2