Function at 0x445170
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bf78
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x130
push esi
push edi
mov eax, dword [0x4c100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4451e6
lea esi, [eax + 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4451d1
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xc]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x44521a
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x445205
mov eax, dword [edi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call dword [eax + 0xc]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x445227
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x446119
cmp word [eax], 0
je 0x446119
mov eax, dword [ebx + 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x70], 0
movups xmmword [ebp - 0xa4], xmm0
test eax, eax
je 0x44529c
cmp dword [eax], 0
jne 0x445283
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x20], 0
mov dword [ebp - 0x78], ecx
jmp 0x4452a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x20]
mov edx, eax
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x78], ecx
jmp 0x4452ae
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x68], eax
cmp dword [ebx + 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xdc], 0xc
mov dword [ebp - 0xd4], 1
je 0x445304
push 0
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
jne 0x445304
mov dword [ebp - 0x5c], eax
or edi, 0xffffffff
mov dword [ebp - 0x70], eax
jmp 0x44605a
test edi, edi
je 0x44532d
push 0
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x74]
push eax
call esi
test eax, eax
jne 0x44532d
mov dword [ebp - 0x60], eax
or edi, 0xffffffff
mov dword [ebp - 0x74], eax
jmp 0x44605a
xor eax, eax
mov dword [ebp - 0xd0], vtable.CVolCommonBaseWithMemManager.0
cmp dword [ebx + 0x10], 0
xorps xmm0, xmm0
mov word [ebp - 0xfe], ax
movlpd qword [ebp - 0x106], xmm0
mov word [ebp - 0x110], ax
mov eax, dword [ebp - 0x104]
cmovne eax, dword [ebp - 0x5c]
test edi, edi
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x100]
cmovne eax, dword [ebp - 0x60]
movlpd qword [ebp - 0x13c], xmm0
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x12c], xmm0
movlpd qword [ebp - 0x124], xmm0
movlpd qword [ebp - 0x11c], xmm0
movlpd qword [ebp - 0x10e], xmm0
mov dword [ebp - 0x140], 0x44
mov dword [ebp - 0x114], 0x101
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xd0], vtable.CVolObject.0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0xd0], vtable.CWString.0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc0], vtable.CVolObject.0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], vtable.CVolMem.0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xa8], 0x40
mov byte [ebp - 4], 2
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xa8], 0xfe
mov dword [ebp - 4], 3
mov dword [ebp - 0x94], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x94], vtable.CVolObject.0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov byte [ebp - 4], 4
mov dword [ebp - 0x94], vtable.CVolMem.0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x7c], 0x40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x94]
mov esi, dword [ebp - 0x18]
push esi
call fcn.00446f60
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x4454ff
cmp word [ecx], 0
jne 0x4454ff
lea edx, [ebp - 0xd0]
mov ecx, esi
call fcn.00444f80
mov ecx, eax
mov eax, dword [ebp - 0x88]
xor edx, edx
cmp dword [ebp - 0x80], edx
cmove eax, edx
lea edx, [ebp - 0xa4]
push edx
lea edx, [ebp - 0x140]
push edx
push ecx
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4455c1
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x94], vtable.CVolMem.0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x88]
test ecx, ecx
je 0x44557e
mov eax, dword [ebp - 0x94]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445576
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x44557e
lea ecx, [ebp - 0x94]
call eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov byte [ebp - 4], 3
mov dword [ebp - 0x94], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.00405340
or edi, 0xffffffff
jmp 0x44605a
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x4455d8
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 0
test edi, edi
je 0x4455ec
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x54], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], vtable.CVolObject.0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], 7
mov dword [ebp - 0x54], vtable.CVolMem.0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0x40
mov byte [ebp - 4], 8
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 9
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov byte [ebp - 4], 0xa
test esi, esi
jne 0x44568c
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4456d5
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
sub eax, esi
cmp eax, 2
jl 0x4456a8
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov word [esi + eax], cx
add dword [ebp - 0x40], 2
jmp 0x4456d2
lea eax, [esi + 2]
cmp eax, esi
jne 0x4456b4
mov eax, dword [ebp - 0x48]
jmp 0x4456cc
test eax, eax
jne 0x4456c3
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
jmp 0x4456cc
push eax
lea ecx, [ebp - 0x54]
call fcn.00446e50
xor ecx, ecx
mov word [eax + esi], cx
mov eax, dword [ebx + 0x20]
test edi, edi
jne 0x4456e1
test eax, eax
je 0x4457c2
mov edx, dword [ebp - 0x28]
mov eax, edx
mov ecx, dword [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x14], ecx
cmp eax, 2
jl 0x445705
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov word [eax + ecx], dx
add dword [ebp - 0x24], 2
jmp 0x4457c2
lea edi, [ecx + 2]
cmp edi, ecx
mov ecx, dword [ebp - 0x2c]
je 0x4457b9
test edi, edi
jne 0x445753
test ecx, ecx
je 0x44573a
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445735
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x44573a
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
xor ecx, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
jmp 0x4457b9
test ecx, ecx
jne 0x445764
push edi
lea ecx, [ebp - 0x38]
call fcn.00446e50
mov ecx, eax
jmp 0x4457b9
mov esi, dword [ebp - 0x20]
mov eax, 0x40
test esi, esi
cmovle esi, eax
cmp edx, edi
jl 0x44577b
sub edx, edi
cmp edx, esi
jle 0x4457b6
mov eax, edi
cdq
idiv esi
mov eax, dword [ebp - 0x38]
sub esi, edx
add esi, edi
push esi
mov eax, dword [eax + 8]
push ecx
cmp eax, method.CWString.virtual_8
jne 0x4457a9
mov ecx, 0x4c51a8
call fcn.00447a10
mov ecx, eax
test ecx, ecx
je 0x446130
jmp 0x4457b0
lea ecx, [ebp - 0x38]
call eax
mov ecx, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x14]
xor edx, edx
mov word [ecx + eax], dx
mov esi, dword [ebx + 0x20]
xor eax, eax
mov dword [ebp - 0x64], eax
test esi, esi
je 0x445805
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xe8], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0xe4], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xf4], 0
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x2c]
nop dword [eax + eax]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44583d
push 0x64
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x445a4a
mov dword [ebp - 0x1c], 0
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x48]
cmp dword [ebx + 0x10], 0
mov dword [ebp - 0x14], 0
je 0x445863
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00444750
mov edi, dword [ebp - 0x48]
add esp, 8
mov esi, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebx + 0x14], eax
je 0x445889
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00444750
mov edi, dword [ebp - 0x48]
add esp, 8
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0
jg 0x445810
test eax, eax
mov eax, dword [ebp - 0x1c]
jg 0x445813
test eax, eax
jne 0x445817
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebx + 0x20], eax
je 0x4458f8
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x64], eax
jne 0x4458f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0xf4], 1
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x14]
add esp, 4
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x1c], eax
mov edx, dword [ebx + 0x10]
test edx, edx
je 0x4459a9
xor eax, eax
cmp dword [ebp - 0x40], eax
cmove edi, eax
mov eax, dword [edx + 0xc]
test eax, eax
jne 0x44591f
cmp dword [edx + 0x24], eax
mov eax, 0x4a49e4
je 0x44591f
mov eax, dword [edx + 0x1c]
cmp edi, eax
je 0x4459a9
mov dword [edx + 0xc], 0
add edx, 0x10
mov dword [ebp - 0x14], edx
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x445949
mov eax, dword [edx]
push ecx
mov ecx, edx
call dword [eax + 0xc]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xc], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x10], 0
test edi, edi
je 0x4459a6
cmp word [edi], 0
je 0x4459a6
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445970
sub ecx, dword [ebp - 0x14]
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4459a6
push eax
mov ecx, edx
call fcn.00446eb0
push dword [ebp - 0x14]
push edi
push eax
call fcn.00478c80
mov esi, dword [ebp - 0x2c]
add esp, 0xc
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x445e92
cmp ecx, edx
jne 0x445e01
call fcn.0043b400
test eax, eax
jne 0x4459d5
push 0x4a9e40
call fcn.00449060
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebx + 0x14]
cmp dword [ebp - 0x24], 0
je 0x445e92
test esi, esi
je 0x445e92
cmp word [esi], 0
je 0x445e92
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x445d45
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445a04
sub ecx, edi
sar ecx, 1
lea edi, [ecx*2 + 2]
mov ecx, dword [ebx + 0x14]
mov dword [ecx + 0x24], 0
cmp dword [ecx + 0x20], edi
jl 0x445d21
cmp edi, 2
jne 0x445cf0
mov ecx, dword [ecx + 0x1c]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [ebx + 0x14]
add dword [ecx + 0x24], edi
jmp 0x445d3e
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x445837
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 0x78]
jb 0x445837
mov dword [ebp - 0x68], eax
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0xf8]
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp - 0x40]
add esp, 4
mov edx, ecx
mov dword [ebp - 0x64], eax
and edx, 1
je 0x445a9b
sub ecx, edx
push ecx
lea ecx, [ebp - 0x54]
call fcn.00446eb0
mov ecx, dword [ebp - 0x24]
mov eax, ecx
and eax, 1
je 0x445ab0
sub ecx, eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00446eb0
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x48]
cmp ecx, 2
jb 0x445ac9
movzx eax, word [ecx + edi - 2]
test ax, ax
je 0x445bbe
mov edx, dword [ebp - 0x44]
mov eax, edx
mov ecx, dword [ebp - 0x40]
sub eax, ecx
cmp eax, 2
jl 0x445ae7
xor eax, eax
mov word [ecx + edi], ax
add dword [ebp - 0x40], 2
jmp 0x445bbb
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
lea ecx, [eax + 2]
cmp ecx, eax
jne 0x445afb
mov ecx, eax
jmp 0x445bb5
test ecx, ecx
jne 0x445b3e
test edi, edi
je 0x445b22
mov eax, dword [ebp - 0x54]
push edi
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445b1d
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x445b22
lea ecx, [ebp - 0x54]
call eax
mov ecx, dword [ebp - 0x18]
xor edi, edi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
jmp 0x445bb5
test edi, edi
jne 0x445b52
push ecx
lea ecx, [ebp - 0x54]
call fcn.00446e50
mov ecx, dword [ebp - 0x18]
mov edi, eax
jmp 0x445bb5
mov esi, dword [ebp - 0x3c]
mov eax, 0x40
test esi, esi
cmovle esi, eax
cmp edx, ecx
jl 0x445b71
sub edx, ecx
cmp edx, esi
jg 0x445b71
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x18]
jmp 0x445bb5
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp - 0x54]
sub esi, edx
add esi, ecx
push esi
mov eax, dword [eax + 8]
push edi
cmp eax, method.CWString.virtual_8
jne 0x445b9f
mov ecx, 0x4c51a8
call fcn.00447a10
mov edi, eax
test edi, edi
je 0x446130
jmp 0x445ba6
lea ecx, [ebp - 0x54]
call eax
mov edi, eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], esi
lea eax, [ecx + 2]
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [edi + ecx], ax
mov edi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
cmp ecx, 2
jb 0x445bd7
movzx eax, word [esi + ecx - 2]
test ax, ax
je 0x445ccf
mov edx, dword [ebp - 0x28]
mov eax, edx
mov ecx, dword [ebp - 0x24]
sub eax, ecx
cmp eax, 2
jl 0x445bf5
xor eax, eax
mov word [esi + ecx], ax
add dword [ebp - 0x24], 2
jmp 0x445cc9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea ecx, [eax + 2]
cmp ecx, eax
jne 0x445c09
mov ecx, eax
jmp 0x445cc3
test ecx, ecx
jne 0x445c4c
test esi, esi
je 0x445c30
mov eax, dword [ebp - 0x38]
push esi
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445c2b
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x445c30
lea ecx, [ebp - 0x38]
call eax
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
jmp 0x445cc3
test esi, esi
jne 0x445c60
push ecx
lea ecx, [ebp - 0x38]
call fcn.00446e50
mov ecx, dword [ebp - 0x18]
mov esi, eax
jmp 0x445cc3
mov edi, dword [ebp - 0x20]
mov eax, 0x40
test edi, edi
cmovle edi, eax
cmp edx, ecx
jl 0x445c7f
sub edx, ecx
cmp edx, edi
jg 0x445c7f
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x18]
jmp 0x445cc3
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp - 0x38]
sub edi, edx
add edi, ecx
push edi
mov eax, dword [eax + 8]
push esi
cmp eax, method.CWString.virtual_8
jne 0x445cad
mov ecx, 0x4c51a8
call fcn.00447a10
mov esi, eax
test esi, esi
je 0x446130
jmp 0x445cb4
lea ecx, [ebp - 0x38]
call eax
mov esi, eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
xor eax, eax
mov word [esi + ecx], ax
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x64]
cmp ecx, 1
je 0x4458f8
cmp ecx, 2
jne 0x44583d
mov dword [ebp - 0x58], 0xfffffffe
jmp 0x4458f8
cmp edi, 4
jne 0x445d04
mov ecx, dword [ecx + 0x1c]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebx + 0x14]
add dword [ecx + 0x24], edi
jmp 0x445d3e
cmp edi, 8
jne 0x445d21
mov eax, dword [ebx + 0x14]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov eax, dword [eax + 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x14]
mov dword [eax + 4], edx
add dword [ecx + 0x24], edi
jmp 0x445d3e
test edi, edi
jle 0x445d3e
push edi
lea ecx, [ecx + 0x10]
call fcn.00446eb0
push edi
push dword [ebp - 0x14]
push eax
call fcn.00478c80
mov ecx, dword [ebx + 0x14]
add esp, 0xc
mov dword [ecx + 0xc], 0
mov edi, dword [ecx + 0x24]
lea eax, [ecx + 0x10]
mov dword [ebp - 0x14], eax
cmp edi, 2
jb 0x445d66
mov eax, dword [ecx + 0x1c]
movzx eax, word [eax + edi - 2]
test ax, ax
jne 0x445d66
add edi, 0xfffffffe
mov dword [ecx + 0x24], edi
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445d70
sub ecx, edx
mov edx, dword [ebx + 0x14]
sar ecx, 1
mov eax, dword [edx + 0x20]
lea ecx, [ecx*2 + 2]
sub eax, edi
mov dword [ebp - 0x64], ecx
cmp eax, ecx
jl 0x445de3
cmp ecx, 2
jne 0x445dad
mov eax, dword [edx + 0x1c]
movzx ecx, word [esi]
mov word [edi + eax], cx
add dword [edx + 0x24], 2
jmp 0x445e92
cmp ecx, 4
jne 0x445dc3
mov eax, dword [edx + 0x1c]
mov ecx, dword [esi]
mov dword [edi + eax], ecx
add dword [edx + 0x24], 4
jmp 0x445e92
cmp ecx, 8
jne 0x445de3
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov esi, dword [ebx + 0x14]
mov eax, dword [esi + 0x1c]
mov dword [edi + eax], ecx
mov dword [edi + eax + 4], edx
add dword [esi + 0x24], 8
jmp 0x445e92
test ecx, ecx
jle 0x445e92
lea eax, [ecx + edi]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.00446eb0
push dword [ebp - 0x64]
add eax, edi
jmp 0x445e88
xor eax, eax
cmp dword [ebp - 0x24], eax
cmove esi, eax
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x445e1d
cmp dword [ecx + 0x24], eax
mov eax, 0x4a49e4
je 0x445e1d
mov eax, dword [ecx + 0x1c]
cmp esi, eax
je 0x445e92
lea edi, [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x445e3a
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0xc]
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
test esi, esi
je 0x445e92
cmp word [esi], 0
je 0x445e92
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445e60
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x445e92
push eax
mov ecx, edi
call fcn.00446eb0
push dword [ebp - 0x14]
push esi
push eax
call fcn.00478c80
add esp, 0xc
mov esi, dword [ebx + 0x1c]
mov edi, dword [ebp - 0x58]
test esi, esi
je 0x445ebc
cmp edi, 0xfffffffe
jne 0x445ea9
mov dword [esi], 0xffffffff
jmp 0x445ebc
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x445ebc
mov dword [esi], eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x38], vtable.CVolMem.0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x445ef1
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445eec
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x445ef1
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 8
mov dword [ebp - 0x38], vtable.CVolObject.0
mov byte [ebp - 4], 5
mov dword [ebp - 0x54], vtable.CVolMem.0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x445f46
mov eax, dword [ebp - 0x54]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445f41
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x445f46
lea ecx, [ebp - 0x54]
call eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 5
mov dword [ebp - 0x54], vtable.CVolObject.0
mov byte [ebp - 4], 3
mov dword [ebp - 0x94], vtable.CVolMem.0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x88]
test ecx, ecx
je 0x445fa7
mov eax, dword [ebp - 0x94]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x445f9f
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x445fa7
lea ecx, [ebp - 0x94]
call eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov byte [ebp - 4], 3
mov dword [ebp - 0x94], vtable.CVolObject.0
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc0], vtable.CVolMem.0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xb4]
test edx, edx
je 0x44601d
mov eax, dword [ebp - 0xc0]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CWString.virtual_12
jne 0x446015
mov ecx, 0x4c51a8
call fcn.00447aa0
jmp 0x44601d
lea ecx, [ebp - 0xc0]
call eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb0], 0
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xc0], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xd0], vtable.CVolObject.0
cmp dword [ebp - 0xa4], 0
je 0x4460d5
cmp dword [ebp - 0x1c], 0
je 0x4460bd
push dword [ebp - 0x9c]
mov esi, dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
call esi
push dword [ebp - 0x9c]
push 1
call esi
push dword [ebp - 0x9c]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4460bd
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa0]
call esi
push dword [ebp - 0xa4]
call esi
jmp 0x4460db
push dword [ebp - 0xa0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa4]
call esi
jmp 0x4460db
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x4460e5
push eax
call esi
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4460ef
push eax
call esi
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x4460f9
push eax
call esi
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x446103
push ecx
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0xffffffffffffffff
call fcn.0047b870
int3