Function at 0x446450
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
cmp dword [0x478840], 0
jne 0x446f76
jmp 0x44646b
mov ax, word [0x4775cc]
mov dx, ax
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
mov cx, ax
sub cx, dx
and cx, 0xb378
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, 0x4c87
add ax, dx
mov dx, cx
and dx, ax
xor cx, ax
or dx, cx
mov word [0x4775d6], dx
mov ax, word [0x4775ce]
xor ax, 0x37e5
mov word [0x4775d8], ax
mov ax, word [0x4775d0]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
or cx, 0xd2df
xor cx, 0xffff
mov dx, ax
or dx, 0x2d20
xor dx, 0xffff
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x2d20
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
mov dx, cx
xor dx, 0xffff
and dx, 0x2d20
and cx, 0xd2df
sub cx, dx
sub ax, cx
mov word [0x4775da], ax
mov ax, word [0x4775d2]
mov cx, ax
xor cx, 0xffff
mov si, ax
and si, cx
mov cx, ax
xor cx, cx
mov dx, ax
add dx, cx
sub dx, si
xor dx, 0xffff
or dx, 0x5078
mov cx, dx
xor cx, 0xffff
and cx, 0x9405
and dx, 0x6bfa
or cx, dx
xor cx, 0x6bfa
mov dx, ax
and dx, 0x5078
mov si, ax
xor si, 0xaf87
add ax, si
sub ax, dx
xor ax, 0xffff
mov dx, cx
and dx, ax
xor cx, ax
or dx, cx
xor dx, 0xffff
and dx, 0xffff
or dx, 0
mov word [0x4775dc], dx
mov ax, word [0x4775d4]
mov cx, ax
xor cx, 0xc8d8
xor cx, 0xffff
and cx, 0xc8d8
shl cx, 1
sub cx, 0xc8d8
sub ax, cx
mov word [0x4775de], ax
mov ax, word [0x47767a]
xor ax, 0xf4a2
mov word [0x477684], ax
mov ax, word [0x47767c]
xor ax, 0xe1cf
mov word [0x477686], ax
mov ax, word [0x47767e]
mov cx, ax
xor cx, 0xffff
and cx, 0xa2fd
and ax, 0x5d02
or cx, ax
mov word [0x477688], cx
mov ax, word [0x477680]
xor ax, 0xf5ec
mov word [0x47768a], ax
mov ax, word [0x477682]
mov cx, ax
xor cx, 0xffff
and cx, 0xe628
and ax, 0x19d7
or cx, ax
xor cx, 0x685
mov word [0x47768c], cx
mov ax, word [0x477600]
xor ax, 0x1a30
mov word [0x477640], ax
mov ax, word [0x477602]
mov cx, ax
or cx, cx
xor cx, 0xffff
or cx, 0x8d43
xor cx, 0xffff
shl cx, 1
sub ax, 0x70e8
add ax, 0x72bc
add ax, 0x70e8
sub ax, cx
mov word [0x477642], ax
mov ax, word [0x477604]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
or cx, 0x2235
mov dx, ax
xor dx, 0xffff
or dx, 0xddca
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0x2235
xor cx, 0xffff
and cx, 0xffff
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0xddca
sub ax, cx
mov word [0x477644], ax
mov ax, word [0x477606]
xor ax, 0x14d0
mov word [0x477646], ax
mov cx, word [0x477608]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
and ax, dx
or ax, 0xb062
xor ax, 0xffff
xor cx, 0xffff
and cx, 0xb062
or ax, cx
xor ax, 0xffff
mov word [0x477648], ax
mov ax, word [0x47760a]
xor ax, 0x1dc1
mov word [0x47764a], ax
mov dx, word [0x47760c]
mov ax, dx
and ax, ax
xor ax, 0xffff
and ax, 0xffff
or ax, 0
xor ax, 0xffff
or ax, 0xbe8c
mov cx, dx
xor cx, 0x4173
and cx, dx
xor cx, 0xffff
xor ax, 0xffff
or cx, cx
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
or ax, cx
mov word [0x47764c], ax
mov ax, word [0x47760e]
mov cx, ax
and cx, 0xe7cc
shl cx, 1
add ax, 0xe7cc
sub ax, cx
mov word [0x47764e], ax
mov ax, word [0x477610]
mov cx, ax
and cx, cx
xor cx, 0xffff
or cx, cx
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
or cx, 0x8574
and ax, 0x8574
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
or cx, ax
mov word [0x477650], cx
mov cx, word [0x477612]
mov ax, cx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
mov dx, cx
xor dx, 0xffff
and ax, dx
mov dx, ax
and dx, 0xffff
shl dx, 1
add ax, 0xffff
sub ax, dx
and ax, 0xc913
or cx, 0xc913
mov dx, cx
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
or dx, 0
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
or ax, dx
mov cx, ax
and cx, 0xffff
shl cx, 1
add ax, 0xffff
sub ax, cx
mov word [0x477652], ax
mov cx, word [0x477614]
mov ax, cx
and ax, ax
xor ax, 0xffff
and ax, 0xe463
xor ax, 0xffff
xor cx, 0xffff
or cx, 0xe463
and ax, cx
xor ax, 0xffff
mov word [0x477654], ax
mov ax, word [0x477616]
mov cx, ax
and cx, 0xc933
shl cx, 1
add ax, 0xc933
sub ax, cx
mov word [str._Ur], ax
mov ax, word [0x477618]
xor ax, 0xc328
mov word [0x477658], ax
mov dx, word [0x47761a]
mov ax, dx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
mov cx, ax
xor cx, 0xb16f
xor cx, 0xffff
or ax, 0xb16f
and ax, cx
mov cx, dx
and cx, 0x4e90
xor cx, 0xffff
and dx, 0x4e90
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
mov di, cx
xor di, 0xffff
mov si, dx
and si, 0x2072
and ax, 0xdf8d
mov bx, di
and bx, 0x2072
and cx, 0xdf8d
or si, ax
or bx, cx
xor si, bx
or dx, di
xor dx, 0xffff
and dx, 0xffff
or si, dx
mov word [0x47765a], si
mov ax, word [0x47761c]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
mov dx, ax
xor dx, 0xffff
mov si, ax
xor si, 0xffff
and dx, si
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0x5027
or ax, ax
xor ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
xor ax, 0xffff
and ax, 0xffff
and ax, 0xafd8
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x47765c], cx
mov ax, word [0x47761e]
mov dx, ax
xor dx, 0xffff
mov cx, ax
xor cx, 0xffff
or dx, cx
and dx, 0xffff
xor dx, 0xffff
xor dx, 0xffff
or dx, 0
mov cx, ax
xor cx, 0xffff
mov si, dx
xor si, cx
xor si, 0xffff
or dx, cx
and dx, si
or dx, 0x2b80
mov cx, dx
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
and cx, 0xffff
xor cx, 0xffff
xor cx, 0xffff
or cx, 0
mov dx, ax
and dx, 0xd47f
xor dx, 0xffff
add ax, 0xd47f
add ax, 1
add ax, dx
xor ax, 0xffff
and ax, 0xffff
or ax, 0
mov dx, cx
and dx, 0xffff
shl dx, 1
add cx, 0xffff
sub cx, dx
mov dx, ax
xor dx, 0xffff
and dx, 0xaff9
and ax, 0x5006
or dx, ax
xor dx, 0x5006
and cx, dx
mov word [0x47765e], cx
mov ax, word [0x477620]
mov cx, ax
and cx, 0xe9c4
shl cx, 1
add ax, 0xe9c4
sub ax, 0x4b9c
sub ax, cx
add ax, 0x4b9c
mov word [0x477660], ax
mov cx, word [0x477622]
mov ax, cx
xor ax, 0xffff
and ax, 0x219
mov dx, cx
xor dx, 0xfde6
xor dx, 0xffff
or cx, 0xfde6
and cx, dx
or ax, cx
mov cx, ax
xor cx, 0xffff
and cx, 0x4e77
and ax, 0xb188
or cx, ax
mov word [0x477662], cx
mov ax, word [0x477624]
mov cx, ax
xor cx, 0xffff
and cx, 0x7a30
and ax, 0x85cf
or cx, ax
xor cx, 0xc1c2
mov word [0x477664], cx
mov ax, word [0x477626]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0xb0b5
or ax, 0xb0b5
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x477666], cx
mov ax, word [0x477628]
mov cx, ax
xor cx, 0xffff
and cx, 0x369e
and ax, 0xc961
or cx, ax
xor cx, 0x2917
mov word [0x477668], cx
mov ax, word [0x47762a]
mov cx, ax
and cx, 0xf6f0
shl cx, 1
add ax, 0xf6f0
sub ax, cx
mov word [0x47766a], ax
mov ax, word [str._O]
mov cx, ax
xor cx, 0xffff
and cx, 0xffff
or cx, 0
and cx, 0x2a28
and ax, 0xd5d7
or cx, ax
mov word [0x47766c], cx
mov ax, word [0x47762e]
mov cx, ax
and cx, 0x206f
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x206f
sub ax, cx
mov word [0x47766e], ax
mov ax, word [0x477630]
xor ax, 0x38a9
mov word [0x477670], ax
mov ax, word [0x477632]
xor ax, 0x12b0
mov word [0x477672], ax
mov ax, word [0x477634]
xor ax, 0x8440
mov word [0x477674], ax
mov ax, word [0x477636]
mov cx, ax
xor cx, 0xfb5
xor cx, 0xffff
and cx, 0xfb5
shl cx, 1
sub cx, 0xfb5
sub ax, cx
mov word [0x477676], ax
mov ax, word [0x477638]
mov cx, ax
xor cx, 0x3554
xor cx, 0xffff
mov dx, cx
xor dx, 0x3554
xor dx, 0xffff
or cx, 0x3554
and cx, dx
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0xf448
sub cx, 0x3554
add cx, 0xf448
sub ax, cx
mov word [0x477678], ax
mov ax, word [0x4775b0]
mov cx, ax
xor cx, 0xc2f4
xor cx, 0xffff
and cx, 0xc2f4
shl cx, 1
sub cx, 0xc2f4
sub ax, cx
mov word [0x4775be], ax
mov ax, word [0x4775b2]
xor ax, 0x2e99
mov word [0x4775c0], ax
mov ax, word [0x4775b4]
mov cx, ax
and cx, 0x5c34
mov si, cx
and si, 0xfffd
mov dx, cx
xor dx, 0xffff
and dx, 2
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x5c34
sub ax, cx
mov word [0x4775c2], ax
mov ax, word [0x4775b6]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
or cx, 0xb618
xor cx, 0xffff
shl cx, 1
mov dx, ax
and dx, 0x49e7
shl dx, 1
xor ax, 0x49e7
add ax, dx
sub ax, cx
mov word [0x4775c4], ax
mov ax, word [0x4775b8]
mov dx, ax
and dx, 0xba6f
shl dx, 1
mov cx, ax
add cx, 0xba6f
sub cx, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
mov dx, cx
xor dx, 0xba6f
xor dx, 0xffff
or cx, 0xba6f
and cx, dx
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
sub cx, 0xb5e2
sub cx, 0xba6f
add cx, 0xb5e2
add ax, 0xd6d5
sub ax, cx
sub ax, 0xd6d5
mov word [0x4775c6], ax
mov ax, word [0x4775ba]
xor ax, 0xd136
mov word [0x4775c8], ax
mov ax, word [0x4775bc]
xor ax, 0x2eee
mov word [0x4775ca], ax
mov cx, word [0x4775e0]
mov ax, cx
xor ax, 0xffff
mov dx, cx
xor dx, 0xffff
or ax, dx
and ax, 0x34d6
xor ax, 0xffff
xor cx, 0xffff
or cx, 0x34d6
and ax, cx
xor ax, 0xffff
mov word [0x4775ea], ax
mov ax, word [0x4775e2]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x1f79
or ax, 0x1f79
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x4775ec], cx
mov ax, word [0x4775e4]
mov cx, ax
xor cx, 0xffff
mov dx, ax
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
and cx, 0x419d
or ax, 0x419d
xor ax, 0xffff
xor cx, 0xffff
xor ax, 0xffff
and cx, ax
mov word [0x4775ee], cx
mov ax, word [0x4775e6]
mov cx, ax
and cx, 0xfc35
shl cx, 1
add ax, 0xfc35
sub ax, cx
mov word [0x4775f0], ax
mov ax, word [0x4775e8]
mov cx, ax
and cx, 0x4c8e
mov dx, cx
xor dx, 0xffff
mov si, dx
and si, 2
or dx, 2
xor dx, 0xffff
imul dx, si
mov si, cx
and si, 2
or cx, 2
imul cx, si
add cx, dx
add ax, 0x4c8e
sub ax, cx
mov word [0x4775f2], ax
jmp 0x446f76
mov dword [0x478840], 1
push eax
mov dword [ebp - 0x38], esp
push eax
mov esi, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov edi, esp
push eax
mov dword [ebp - 0xa8], esp
push eax
mov dword [ebp - 0xa4], esp
push eax
mov dword [ebp - 0x5c], esp
push eax
mov dword [ebp - 0x11c], esp
push eax
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0xa0], esp
push eax
mov dword [ebp - 0x54], esp
push eax
mov dword [ebp - 0x9c], esp
push eax
mov dword [ebp - 0x98], esp
push eax
mov dword [ebp - 0x94], esp
push eax
mov dword [ebp - 0x118], esp
push eax
mov dword [ebp - 0x90], esp
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 8
mov dword [ebp - 0x48], esp
push eax
mov dword [ebp - 0x8c], esp
push eax
mov dword [ebp - 0x88], esp
push eax
mov dword [ebp - 0x114], esp
push eax
mov dword [ebp - 0x110], esp
push eax
mov dword [ebp - 0x10c], esp
push eax
mov dword [ebp - 0x84], esp
push eax
mov dword [ebp - 0x80], esp
push eax
mov dword [ebp - 0x7c], esp
push eax
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x78], esp
push eax
mov dword [ebp - 0x108], esp
sub esp, 8
mov dword [ebp - 0x104], esp
push eax
mov dword [ebp - 0x74], esp
push eax
mov dword [ebp - 0x70], esp
push eax
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x6c], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov dword [ebp - 0x100], esp
sub esp, 8
mov dword [ebp - 0xfc], esp
push eax
mov dword [ebp - 0xf8], esp
push eax
mov dword [ebp - 0x30], esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x80
mov dword [ebp - 0x3c], esp
sub esp, 0x400
mov dword [ebp - 0x14], esp
sub esp, 0x10
mov dword [ebp - 0xf0], esp
push eax
mov dword [ebp - 0xec], esp
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0xc
mov dword [ebp - 0xe4], esp
sub esp, 0x400
mov dword [ebp - 0xe0], esp
sub esp, 0x44
mov dword [ebp - 0xdc], esp
sub esp, 0x10
mov dword [ebp - 0xd8], esp
sub esp, 0xc
mov dword [ebp - 0xd0], esp
sub esp, 0x400
mov dword [ebp - 0xcc], esp
sub esp, 0xc
mov dword [ebp - 0xc8], esp
push eax
sub esp, 0x3fc
mov dword [ebp - 0xc4], esp
sub esp, 0x3c
mov dword [ebp - 0xc0], esp
sub esp, 0x400
mov dword [ebp - 0xbc], esp
sub esp, 0x44
mov dword [ebp - 0xb8], esp
sub esp, 0x10
mov dword [ebp - 0xb4], esp
sub esp, 8
mov dword [ebp - 0xe8], esp
push eax
mov dword [ebp - 0xd4], esp
push eax
mov dword [ebp - 0xf4], esp
call fcn.0044d5d0
mov dword [esi], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call section..text
add esp, 4
mov dword [ebx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.004015c0
add esp, 4
cmp eax, 4
je 0x447178
jmp 0x447151
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401700
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 1
jmp 0x4484bf
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401380
add esp, 4
mov dword [edi], eax
mov eax, dword [edi]
lea ecx, [0x46b6ea]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
jne 0x4471d8
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401700
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 1
jmp 0x4484bb
mov eax, dword [edi]
lea ecx, [0x46b6ec]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401570
add esp, 0xc
cmp eax, 0
jne 0x447226
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401700
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 1
jmp 0x4484bb
mov dword [ebp - 0x120], ebx
mov eax, dword [edi]
lea ecx, [0x46b6ee]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013a0
add esp, 8
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], eax
mov dword [ebp - 0x124], edi
mov eax, dword [edi]
lea ecx, [0x46b6ec]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013a0
add esp, 8
mov edi, dword [ebp - 0xa4]
mov dword [edi], eax
mov ebx, dword [ebp - 0x5c]
mov dword [ebx], 0
mov esi, dword [ebx]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00401640
add esp, 4
cmp esi, eax
jb 0x4472a3
mov esi, dword [ebp - 0x10]
mov dword [esi], 2
jmp 0x448383
mov eax, dword [ebx]
mov ecx, dword [edi]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401660
add esp, 8
mov edi, dword [ebp - 0x11c]
mov dword [edi], eax
mov eax, dword [edi]
lea ecx, [0x46b6f1]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
mov esi, dword [ebp - 0x10]
jne 0x4472f6
mov dword [esi], 4
jmp 0x44835f
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6f1
call fcn.00401330
add esp, 8
fnstcw word [ebp - 0x26]
movzx eax, word [ebp - 0x26]
or eax, 0xc00
mov word [ebp - 0x66], ax
fldcw word [ebp - 0x66]
fistp dword [ebp - 0x138]
fldcw word [ebp - 0x26]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
cmp dword [ecx], 0
sete al
test al, 1
jne 0x447344
jmp 0x4477bc
jmp 0x447346
mov eax, dword [edi]
lea ecx, [0x46b6f3]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447377
jmp 0x44741c
mov eax, dword [edi]
lea ecx, [0x46b6f5]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 5
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x44741c
jmp 0x4473a0
mov eax, dword [edi]
lea ecx, [0x46b6f7]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4473ce
jmp 0x44741c
mov eax, dword [edi]
lea ecx, [0x46b6f9]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x44741c
mov eax, dword [edi]
lea ecx, [0x46b6fb]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
jne 0x447427
mov dword [esi], 4
jmp 0x44835f
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6f3
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6f5
call fcn.004013a0
add esp, 8
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6f7
call fcn.004012e0
add esp, 8
mov esi, dword [ebp - 0x9c]
mov dword [esi], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6f9
call fcn.00401330
add esp, 8
fnstcw word [ebp - 0x24]
movzx eax, word [ebp - 0x24]
or eax, 0xc00
mov word [ebp - 0x64], ax
fldcw word [ebp - 0x64]
fistp dword [ebp - 0x128]
fldcw word [ebp - 0x24]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6fb
call fcn.00401330
add esp, 8
fnstcw word [ebp - 0x22]
movzx eax, word [ebp - 0x22]
or eax, 0xc00
mov word [ebp - 0x62], ax
fldcw word [ebp - 0x62]
fistp dword [ebp - 0x12c]
fldcw word [ebp - 0x22]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ebx, dword [ebp - 0x118]
mov dword [ebx], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebx]
shl eax, 1
mov ecx, eax
and ecx, 2
or eax, 2
add ecx, eax
sub esp, 4
mov dword [esp], ecx
call fcn.00457c74
add esp, 4
mov edi, dword [ebp - 0x50]
mov dword [edi], eax
mov eax, dword [esi]
mov edx, eax
and edx, 0xfffffffd
mov ecx, eax
or ecx, 0xfffffffd
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
add eax, ecx
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00457c74
add esp, 4
mov esi, dword [ebp - 0x4c]
mov dword [esi], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [ebx]
mov word [eax + ecx*2], 0
mov edi, dword [ebp - 0x90]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 1
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
call fcn.0042fbd0
mov ebx, dword [ebp - 0x54]
add esp, 8
mov edi, dword [ebp - 0x8c]
mov dword [edi], 0
mov esi, dword [edi]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00401640
add esp, 4
cmp esi, eax
jb 0x44763f
mov esi, dword [ebp - 0x10]
jmp 0x447634
mov dword [esi], 5
jmp 0x447780
mov eax, dword [edi]
mov ecx, dword [ebx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004015e0
add esp, 8
mov ecx, dword [ebp - 0x88]
mov dword [ecx], eax
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.004015c0
add esp, 4
cmp eax, 2
jne 0x447771
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401300
add esp, 4
mov esi, dword [ebp - 0x114]
mov dword [esi], eax
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov edi, dword [ebp - 0x110]
mov dword [edi], eax
mov edx, dword [edi]
shl edx, 1
mov ecx, edx
and ecx, 2
shl ecx, 1
mov eax, edx
xor eax, 0xffffffff
and eax, 2
and edx, 0xfffffffd
or eax, edx
sub eax, 0x62c868c
add eax, ecx
add eax, 0x62c868c
sub esp, 4
mov dword [esp], eax
call fcn.00457c74
add esp, 4
mov ebx, dword [ebp - 0x10c]
mov dword [ebx], eax
mov eax, dword [edi]
mov ecx, dword [esi]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
mov esi, dword [ebx]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], esi
mov edi, dword [ebp - 0x8c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0xac]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0x14], eax
call fcn.0040b3b0
add esp, 0x18
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [edi]
add eax, 1
mov dword [edi], eax
mov ebx, dword [ebp - 0x54]
jmp 0x447619
sub esp, 4
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.0042fca0
add esp, 4
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
jmp 0x448359
mov eax, dword [ebp - 0x58]
cmp dword [eax], 1
jne 0x447a09
call fcn.004061f0
mov eax, dword [edi]
lea ecx, [0x46b6f3]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x44781b
mov eax, dword [edi]
lea ecx, [0x46b6f7]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
jne 0x447826
mov dword [esi], 4
jmp 0x44835f
mov eax, dword [edi]
lea ecx, [0x46b6f3]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0x84]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [edi]
lea ecx, [0x46b6f7]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0x80]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov ebx, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebx]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xffffffff
or edx, 0
or edx, 0xfffffffd
add edx, 3
mov ebx, eax
and ebx, 0xfffffffd
imul ebx, edx
mov edx, eax
xor edx, 0xffffffff
or edx, 0xfffffffd
xor edx, 0xffffffff
and edx, 0xffffffff
or eax, 2
mov esi, eax
xor esi, 0xffffffff
mov edi, edx
and edi, esi
mov esi, edx
xor esi, 0xffffffff
mov ecx, eax
and ecx, esi
imul ecx, edi
mov esi, eax
and esi, edx
or eax, edx
imul eax, esi
add eax, ecx
sub eax, 0x16ddf1ce
add eax, ebx
add eax, 0x16ddf1ce
add eax, 2
sub esp, 4
mov dword [esp], eax
call fcn.00457c74
add esp, 4
mov ebx, dword [ebp - 0x78]
mov dword [ebx], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
shl eax, 1
add eax, 0x873b24ff
sub eax, 0xfffffffe
sub eax, 0x873b24ff
sub esp, 4
mov dword [esp], eax
call fcn.00457c74
add esp, 4
mov esi, dword [ebp - 0x108]
mov dword [esi], eax
mov edi, dword [ebp - 0x7c]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
mov edi, dword [ebp - 0x44]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov edx, dword [esi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 2
mov ebx, dword [ebp - 0x104]
mov dword [esp + 4], ebx
call fcn.0042fbd0
add esp, 8
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
mov ecx, dword [esi]
mov edi, dword [ebp - 0x78]
mov edx, dword [edi]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
call fcn.00402fa0
add esp, 0xc
mov dword [esp], ebx
call fcn.0042fca0
add esp, 4
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov esi, dword [ebp - 0x10]
jmp 0x448353
jmp 0x447a0b
cmp dword [eax], 2
sete al
test al, 1
jne 0x447a1a
jmp 0x447c7b
jmp 0x447a1c
mov eax, dword [edi]
lea ecx, [0x46b6f3]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447a4a
jmp 0x447a7a
jmp 0x447a4c
mov eax, dword [edi]
lea ecx, [0x46b6f7]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x447a85
jmp 0x447a7a
mov dword [esi], 4
jmp 0x44835f
mov eax, dword [edi]
lea ecx, [0x46b6f3]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
lea ecx, [0x46b6f7]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov edi, dword [ebp - 0x6c]
mov dword [edi], eax
mov ebx, dword [esi]
mov edx, ebx
xor edx, 0xffffffff
mov ecx, ebx
xor ecx, 0xffffffff
and edx, ecx
xor edx, 0xffffffff
and edx, 0xffffffff
xor edx, 0xffffffff
and edx, 0xffffffff
and edx, 2
mov eax, ebx
and eax, 0xfffffffd
imul eax, edx
mov dword [ebp - 0xb0], eax
mov edx, ebx
and edx, 2
xor edx, 0xffffffff
mov esi, ebx
and esi, 2
xor esi, 0xffffffff
and edx, esi
xor edx, 0xffffffff
mov esi, ebx
and esi, 0xfffffffd
mov eax, ebx
xor eax, 2
add ebx, eax
sub ebx, esi
mov eax, ebx
xor eax, 0xffffffff
mov esi, edx
and esi, eax
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ebx
and eax, ecx
imul eax, esi
mov esi, dword [ebp - 0x10]
mov ecx, ebx
and ecx, edx
or ebx, edx
imul ebx, ecx
add ebx, eax
sub ebx, 0x4c45a38c
add ebx, dword [ebp - 0xb0]
add ebx, 0x4c45a38c
add ebx, 2
sub esp, 4
mov dword [esp], ebx
call fcn.00457c74
add esp, 4
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [edi]
shl eax, 1
mov ecx, eax
and ecx, 2
or eax, 2
add ecx, eax
sub esp, 4
mov dword [esp], ecx
call fcn.00457c74
add esp, 4
mov ebx, dword [ebp - 0x100]
mov dword [ebx], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
mov edi, dword [ebp - 0x34]
mov edx, dword [edi]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [edi]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov word [eax + ecx*2], 0
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov edx, dword [ebx]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00457c9f
add esp, 0xc
mov eax, dword [ebx]
mov ecx, dword [edi]
mov word [eax + ecx*2], 0
sub esp, 8
mov dword [esp], 3
mov edi, dword [ebp - 0xfc]
mov dword [esp + 4], edi
call fcn.0042fbd0
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edi
call fcn.004488b0
add esp, 8
mov dword [esp], edi
call fcn.0042fca0
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
jmp 0x448351
mov eax, dword [ebp - 0x58]
cmp dword [eax], 3
jne 0x447c88
jmp 0x44834f
cmp dword [eax], 4
jne 0x44834d
mov eax, dword [edi]
lea ecx, [0x46b6fe]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
mov ebx, dword [ebp - 0xf8]
mov dword [ebx], eax
mov eax, dword [edi]
lea ecx, [0x46b700]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [edi]
lea ecx, [0x46b703]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
mov dword [ebx], eax
mov eax, dword [edi]
lea ecx, [0x46b6fe]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x447d78
mov eax, dword [edi]
lea ecx, [0x46b700]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x447d78
mov eax, dword [edi]
lea ecx, [0x46b703]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 3
call fcn.00401570
add esp, 0xc
cmp eax, 0
jne 0x447d83
mov dword [esi], 4
jmp 0x448342
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b6fe
call fcn.004012e0
add esp, 8
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b700
call fcn.00401330
add esp, 8
fnstcw word [ebp - 0x20]
movzx eax, word [ebp - 0x20]
or eax, 0xc00
mov word [ebp - 0x60], ax
fldcw word [ebp - 0x60]
fistp dword [ebp - 0x130]
fldcw word [ebp - 0x20]
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x46b703
call fcn.00401330
add esp, 8
fnstcw word [ebp - 0x1e]
movzx eax, word [ebp - 0x1e]
or eax, 0xc00
mov word [ebp - 0x5e], ax
fldcw word [ebp - 0x5e]
fistp dword [ebp - 0x134]
fldcw word [ebp - 0x1e]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
sub esp, 0xc
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov dword [esp + 8], 0x80
mov dword [esp + 4], 0
call fcn.00452cd0
mov edi, dword [ebp - 0x14]
mov dword [esp], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
call fcn.00452cd0
add esp, 0xc
mov ax, word [0x4775ca]
mov ecx, dword [ebp - 0xf0]
mov word [ecx + 0xc], ax
mov eax, dword [0x4775c6]
mov dword [ecx + 8], eax
mov eax, dword [0x4775c2]
mov dword [ecx + 4], eax
mov eax, dword [0x4775be]
mov dword [ecx], eax
sub esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], ecx
mov dword [esp + 8], 0x200
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
call fcn.004484d0
sub esp, 4
mov dword [esp], eax
call fcn.00457f4c
add esp, 4
call fcn.00457f5e
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
xor eax, 0xa
xor eax, 0xffffffff
mov ecx, edx
or ecx, 0xa
and ecx, eax
or edx, 0xa
add ecx, edx
mov edi, dword [ebp - 0xec]
mov dword [edi], ecx
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0
jmp 0x447ee1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
cmp eax, dword [edi]
setl al
test al, 1
jne 0x447ef9
jmp 0x447ef1
mov dword [esi], 8
jmp 0x447f2e
jmp 0x447efb
call fcn.00457f5e
mov ecx, 0x18
cdq
idiv ecx
add edx, 0x793d061a
add edx, 0x86c2fa47
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov word [ecx + eax*2], dx
jmp 0x447f22
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx]
add eax, 1
mov dword [ecx], eax
jmp 0x447edf
lea eax, [0x46a13c]
sub esp, 8
mov edi, dword [ebp - 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0045b6b5
mov dword [esp], edi
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.0045b6b5
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x4480c4
mov eax, dword [0x477684]
mov ecx, dword [ebp - 0xe4]
mov dword [ecx], eax
mov eax, dword [0x477688]
mov dword [ecx + 4], eax
mov ax, word [0x47768c]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045b6b5
add esp, 8
mov esi, dword [ebp - 0x18]
cmp dword [esi], 0
jne 0x447ff7
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xe0]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00452cd0
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00457c9f
add esp, 4
mov dword [esp], edi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042f330
add esp, 8
cmp dword [esi], 0
jne 0x4480b6
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xdc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00452cd0
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xd8]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00452cd0
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
jmp 0x4480b6
cmp dword [esi], 1
jne 0x4480bd
jmp 0x4480bd
jmp 0x4480bf
mov esi, dword [ebp - 0x10]
jmp 0x4480c4
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 1
jne 0x448192
mov eax, dword [0x4775d6]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx], eax
mov eax, dword [0x4775da]
mov dword [ecx + 4], eax
mov ax, word [0x4775de]
mov word [ecx + 8], ax
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0045b6b5
add esp, 8
mov esi, dword [ebp - 0x18]
cmp dword [esi], 0
jl 0x44816d
cmp dword [esi], 1
jg 0x44816d
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xcc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00452cd0
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00457c9f
add esp, 4
mov dword [esp], esi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.0042f330
add esp, 8
mov esi, dword [ebp - 0x18]
jmp 0x44816d
cmp dword [esi], 0
jne 0x448181
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [esi], 1
jne 0x448188
jmp 0x448188
cmp dword [esi], 2
jne 0x44818f
jmp 0x44818f
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 2
jne 0x448320
mov eax, dword [0x4775ea]
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
mov eax, dword [0x4775ee]
mov dword [ecx + 4], eax
mov ax, word [0x4775f2]
mov word [ecx + 8], ax
sub esp, 8
mov esi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], ecx
call fcn.0045b6b5
add esp, 8
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xc4]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
call fcn.00452cd0
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x200
call fcn.00457c9f
add esp, 4
mov dword [esp], edi
mov dword [esp + 4], esi
call fcn.0042f330
add esp, 8
lea eax, [0x477640]
sub esp, 0xc
mov edi, dword [ebp - 0xc0]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3a
call fcn.004521d0
sub esp, 4
mov ebx, dword [ebp - 0xbc]
mov dword [esp], ebx
mov dword [esp + 4], 0x200
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.004484e0
add esp, 0x10
xor eax, eax
sub esp, 0xc
mov esi, dword [ebp - 0xb8]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.00452cd0
add esp, 0xc
mov dword [esi], 0x44
xor eax, eax
sub esp, 0xc
mov edi, dword [ebp - 0xb4]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x10
call fcn.00452cd0
add esp, 0xc
xor eax, eax
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
jmp 0x448320
jmp 0x448322
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 3
sete al
test al, 1
jne 0x448331
jmp 0x44833a
jmp 0x448333
jmp 0x448335
mov esi, dword [ebp - 0x10]
jmp 0x44833a
mov dword [esi], 0
jmp 0x448342
cmp dword [esi], 0
jne 0x44835f
jmp 0x448349
jmp 0x44834b
jmp 0x44834d
jmp 0x44834f
jmp 0x448351
jmp 0x448353
jmp 0x448355
jmp 0x448357
jmp 0x448359
mov dword [esi], 0
mov eax, dword [esi]
test eax, eax
je 0x44836c
jmp 0x448367
mov ebx, dword [ebp - 0x5c]
jmp 0x448371
mov ebx, dword [ebp - 0x5c]
jmp 0x448371
mov eax, dword [ebx]
sub eax, 0xffffffff
mov dword [ebx], eax
mov edi, dword [ebp - 0xa4]
jmp 0x44727f
mov edi, dword [ebp - 0x124]
mov ebx, dword [ebp - 0xe8]
call fcn.00446400
sub esp, 8
mov dword [esp], 1
mov dword [esp + 4], ebx
call fcn.0042fbd0
add esp, 4
mov dword [esp], ebx
call fcn.0044adc0
mov dword [esp], ebx
call fcn.0044a600
add esp, 4
mov eax, dword [edi]
lea ecx, [0x46b705]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401570
add esp, 0xc
cmp eax, 0
setne al
test al, 1
jne 0x4483eb
jmp 0x44842b
mov eax, dword [edi]
lea ecx, [0x46b705]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013e0
add esp, 8
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
cmp dword [ecx], 0
setne al
test al, 1
jne 0x448419
jmp 0x448427
sub esp, 4
mov dword [esp], ebx
call fcn.00449260
add esp, 4
jmp 0x448429
jmp 0x44842b
sub esp, 4
mov dword [esp], ebx
call fcn.0042fca0
add esp, 4
mov ebx, dword [ebp - 0xf4]
mov dword [ebx], 0
mov eax, dword [edi]
lea ecx, [0x46b708]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
call fcn.00401570
add esp, 0xc
cmp eax, 0
je 0x448488
mov eax, dword [edi]
lea ecx, [0x46b708]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004013e0
add esp, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00401700
add esp, 4
cmp dword [ebx], 0
je 0x4484a8
call fcn.004493f0
jmp 0x4484aa
mov eax, dword [ebp - 0x38]
mov dword [eax], 1
mov dword [esi], 1
jmp 0x4484bb
jmp 0x4484bd
jmp 0x4484bf
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret