Function at 0x401ad0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], str.__c
push 0
push 0
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x401ec2
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 4]
push edx
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x401b4e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 0x68]
jmp 0x402986
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x6c]
cmp edx, dword [ebp - 4]
jb 0x401b75
mov eax, dword [ebp - 0x6c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x401b75
mov edx, dword [ebp - 0x6c]
sub edx, 1
mov dword [ebp - 0x6c], edx
jmp 0x401b57
mov eax, dword [ebp - 0x6c]
add eax, 1
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x401c10
push str.command.com
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x401c10
mov edi, dword [ebp - 0x50]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 0x54]
add edx, ecx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x68]
xor eax, eax
mov edi, dword [ebp - 0x4c]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x43b1a8
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x401ec0
push 0x104
lea edx, [ebp - 0x194]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
test eax, eax
je 0x401c2c
jmp 0x401c6e
mov dword [ebp - 0x68], 0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x54], ecx
jmp 0x401c44
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
movsx ecx, byte [ebp + eax - 0x194]
test ecx, ecx
je 0x401c6e
mov edx, dword [ebp - 0x54]
movsx eax, byte [ebp + edx - 0x194]
cmp eax, 0x5c
jne 0x401c6c
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x68], ecx
jmp 0x401c3b
mov edx, dword [ebp - 0x68]
mov byte [ebp + edx - 0x194], 0
lea edi, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov eax, 0x104
sub eax, ecx
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x194]
push edx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
je 0x401df4
push 0x104
push 0x43b1a4
lea edx, [ebp - 0x194]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea edi, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
movsx eax, byte [ebp + ecx - 0x195]
cmp eax, 0x5c
je 0x401d33
mov edi, 0x43b1a0
lea edx, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov eax, 0x104
sub eax, ecx
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x194]
push edx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
je 0x401df4
mov edx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov dword [ebp - 0x5a4], edx
push str._which_is_needed_for_popen_to_work_with_your_shell_or_platform.
lea eax, [ebp - 0x194]
push eax
push str.Can_not_locate_
mov ecx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
mov dword [ebp - 0x5a0], eax
mov edx, dword [ebp - 0x5a0]
push edx
call dword [ebp - 0x5a4]
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x402986
mov edi, dword [ebp - 0x50]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov edx, dword [ebp - 0x54]
add edx, ecx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
add edx, ecx
lea edi, [ebp - 0x194]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea edx, [edx + ecx + 1]
mov edi, dword [ebp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x4c], 0
je 0x401e58
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x68]
xor eax, eax
mov edi, dword [ebp - 0x4c]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x194]
push eax
push str._s__s_s_s
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x194]
push eax
push 0x43b134
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x401f28
mov edx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov dword [ebp - 0x5ac], edx
push str.use_as_the_shell
push str.Cannot_locate_a_COMSPEC_environment_variable_to
mov eax, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
mov dword [ebp - 0x5a8], eax
mov ecx, dword [ebp - 0x5a8]
push ecx
call dword [ebp - 0x5ac]
add esp, 4
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
jmp 0x402986
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov word [ebp - 0x18], 0
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push 1
push 0
push 0
mov ecx, dword [ebp - 0x4c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401fb6
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
jmp 0x402986
mov edi, str.CreateProcessError:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x5c0], ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ebp + 0x28]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
cmp eax, dword [ebp - 0x5c0]
ja 0x401fe9
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x5c0], 0
jbe 0x402087
push 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x5c0]
mov dword [ebp - 0x5b0], edx
mov eax, dword [ebp - 0x5b0]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x402087
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + 0x28]
add edx, dword [eax + 8]
mov dword [ebp - 0x5b4], edx
mov ecx, dword [ebp - 0x5c0]
mov esi, str.CreateProcessError:
mov edi, dword [ebp - 0x5b4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x5b8], 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp - 0x5b0]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x5bc], eax
mov ecx, dword [ebp - 0x5bc]
mov dl, byte [ebp - 0x5b8]
mov byte [ecx], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
push 0
push 0x3ff
lea eax, [ebp - 0x59c]
push eax
push 0x400
mov ecx, dword [ebp - 0x198]
push ecx
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jae 0x4020f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x198]
push edx
push str.Process_execution_failed_with_error_0x_X.__FormatMessage_failed_with_error_0x_X
push 0x3ff
lea eax, [ebp - 0x59c]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edi, [ebp - 0x59c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x5d4], ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ebp + 0x28]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
cmp eax, dword [ebp - 0x5d4]
ja 0x402125
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x5d4], 0
jbe 0x4021c4
push 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x5c4], edx
mov eax, dword [ebp - 0x5c4]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x4021c4
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + 0x28]
add edx, dword [eax + 8]
mov dword [ebp - 0x5c8], edx
mov ecx, dword [ebp - 0x5d4]
lea esi, [ebp - 0x59c]
mov edi, dword [ebp - 0x5c8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x5cc], 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp - 0x5c4]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x5d0], eax
mov ecx, dword [ebp - 0x5d0]
mov dl, byte [ebp - 0x5cc]
mov byte [ecx], dl
mov edi, 0x43b080
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x5e8], ecx
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [ebp + 0x28]
mov edx, dword [eax]
sub edx, dword [ecx + 8]
cmp edx, dword [ebp - 0x5e8]
ja 0x4021f6
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x5e8], 0
jbe 0x402294
push 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x5e8]
mov dword [ebp - 0x5d8], ecx
mov edx, dword [ebp - 0x5d8]
push edx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x402294
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0x28]
add ecx, dword [edx + 8]
mov dword [ebp - 0x5dc], ecx
mov ecx, dword [ebp - 0x5e8]
mov esi, 0x43b080
mov edi, dword [ebp - 0x5dc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x5e0], 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp - 0x5d8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
add ecx, dword [ebp - 0x5d8]
mov dword [ebp - 0x5e4], ecx
mov edx, dword [ebp - 0x5e4]
mov al, byte [ebp - 0x5e0]
mov byte [edx], al
mov edi, str.for_command:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x5fc], ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ebp + 0x28]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
cmp eax, dword [ebp - 0x5fc]
ja 0x4022c7
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x5fc], 0
jbe 0x402365
push 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x5fc]
mov dword [ebp - 0x5ec], edx
mov eax, dword [ebp - 0x5ec]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x402365
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + 0x28]
add edx, dword [eax + 8]
mov dword [ebp - 0x5f0], edx
mov ecx, dword [ebp - 0x5fc]
mov esi, str.for_command:
mov edi, dword [ebp - 0x5f0]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x5f4], 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp - 0x5ec]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x5f8], eax
mov ecx, dword [ebp - 0x5f8]
mov dl, byte [ebp - 0x5f4]
mov byte [ecx], dl
mov edi, dword [ebp - 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x610], ecx
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [ebp + 0x28]
mov edx, dword [eax]
sub edx, dword [ecx + 8]
cmp edx, dword [ebp - 0x610]
ja 0x402395
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x610], 0
jbe 0x402431
push 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x610]
mov dword [ebp - 0x600], ecx
mov edx, dword [ebp - 0x600]
push edx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x402431
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0x28]
add ecx, dword [edx + 8]
mov dword [ebp - 0x604], ecx
mov ecx, dword [ebp - 0x610]
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x604]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x608], 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp - 0x600]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
add ecx, dword [ebp - 0x600]
mov dword [ebp - 0x60c], ecx
mov edx, dword [ebp - 0x60c]
mov al, byte [ebp - 0x608]
mov byte [edx], al
cmp dword [ebp + 0xc], 0
je 0x40270a
mov edi, str._nin_dir:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x624], ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ebp + 0x28]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
cmp eax, dword [ebp - 0x624]
ja 0x40246e
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x624], 0
jbe 0x40250c
push 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x624]
mov dword [ebp - 0x614], edx
mov eax, dword [ebp - 0x614]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
and eax, 0xff
test eax, eax
je 0x40250c
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + 0x28]
add edx, dword [eax + 8]
mov dword [ebp - 0x618], edx
mov ecx, dword [ebp - 0x624]
mov esi, str._nin_dir:
mov edi, dword [ebp - 0x618]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x61c], 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp - 0x614]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x614]
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
mov dl, byte [ebp - 0x61c]
mov byte [ecx], dl
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x63c], ecx
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [ebp + 0x28]
mov edx, dword [eax]
sub edx, dword [ecx + 8]
cmp edx, dword [ebp - 0x63c]
ja 0x40253c
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x63c], 0
jbe 0x40270a
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x628], ecx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::max_size_void_const]
cmp eax, dword [ebp - 0x628]
jae 0x402572
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov edx, dword [ebp + 0x28]
cmp dword [edx + 4], 0
je 0x4025fa
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
xor edx, edx
mov dl, byte [ecx - 1]
test edx, edx
je 0x4025fa
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
xor edx, edx
mov dl, byte [ecx - 1]
cmp edx, 0xff
je 0x4025fa
cmp dword [ebp - 0x628], 0
jne 0x4025de
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
sub ecx, 1
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x660]
mov al, byte [edx]
sub al, 1
mov ecx, dword [ebp - 0x660]
mov byte [ecx], al
push 0
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [ebp - 0x62c], 0
jmp 0x402698
mov edx, dword [ebp - 0x628]
push edx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov byte [ebp - 0x62c], 1
jmp 0x402698
cmp dword [ebp - 0x628], 0
jne 0x402633
xor eax, eax
test eax, eax
je 0x402616
push 1
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x40262a
mov ecx, dword [ebp + 0x28]
cmp dword [ecx + 4], 0
je 0x40262a
push 0
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov byte [ebp - 0x62c], 0
jmp 0x402698
xor edx, edx
test edx, edx
je 0x40266d
mov eax, dword [ebp + 0x28]
cmp dword [eax + 0xc], 0x1f
ja 0x402650
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 0xc]
cmp edx, dword [ebp - 0x628]
jae 0x40266d
push 1
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [ebp - 0x628]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
jmp 0x402691
xor ecx, ecx
test ecx, ecx
jne 0x402691
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 0xc]
cmp eax, dword [ebp - 0x628]
jae 0x402691
mov ecx, dword [ebp - 0x628]
push ecx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov byte [ebp - 0x62c], 1
mov edx, dword [ebp - 0x62c]
and edx, 0xff
test edx, edx
je 0x40270a
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0x28]
add ecx, dword [edx + 8]
mov dword [ebp - 0x630], ecx
mov ecx, dword [ebp - 0x63c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x630]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x634], 0
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp - 0x628]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 4]
add ecx, dword [ebp - 0x628]
mov dword [ebp - 0x638], ecx
mov edx, dword [ebp - 0x638]
mov al, byte [ebp - 0x634]
mov byte [edx], al
mov edi, 0x43b080
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x65c], ecx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov edx, dword [ebp + 0x28]
mov eax, dword [ecx]
sub eax, dword [edx + 8]
cmp eax, dword [ebp - 0x65c]
ja 0x40273d
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
cmp dword [ebp - 0x65c], 0
jbe 0x40296a
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 0x65c]
mov dword [ebp - 0x640], edx
mov dword [ebp - 0x648], 0xffffffff
cmp dword [ebp - 0x648], 0
jbe 0x40277d
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x664], eax
jmp 0x402787
mov dword [ebp - 0x664], 1
mov ecx, dword [ebp - 0x664]
mov dword [ebp - 0x644], ecx
cmp dword [ebp - 0x644], 2
ja 0x4027a8
mov dword [ebp - 0x668], 1
jmp 0x4027b7
mov edx, dword [ebp - 0x644]
sub edx, 2
mov dword [ebp - 0x668], edx
mov eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x640]
jae 0x4027cb
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 0x28]
cmp dword [ecx + 4], 0
je 0x402858
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
xor ecx, ecx
mov cl, byte [eax - 1]
test ecx, ecx
je 0x402858
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
xor ecx, ecx
mov cl, byte [eax - 1]
cmp ecx, 0xff
je 0x402858
cmp dword [ebp - 0x640], 0
jne 0x40283c
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
sub eax, 1
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp - 0x66c]
mov dl, byte [ecx]
sub dl, 1
mov eax, dword [ebp - 0x66c]
mov byte [eax], dl
push 0
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov byte [ebp - 0x64c], 0
jmp 0x4028f6
mov ecx, dword [ebp - 0x640]
push ecx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov byte [ebp - 0x64c], 1
jmp 0x4028f6
cmp dword [ebp - 0x640], 0
jne 0x402891
xor edx, edx
test edx, edx
je 0x402874
push 1
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
jmp 0x402888
mov eax, dword [ebp + 0x28]
cmp dword [eax + 4], 0
je 0x402888
push 0
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov byte [ebp - 0x64c], 0
jmp 0x4028f6
xor ecx, ecx
test ecx, ecx
je 0x4028cb
mov edx, dword [ebp + 0x28]
cmp dword [edx + 0xc], 0x1f
ja 0x4028ae
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 0xc]
cmp ecx, dword [ebp - 0x640]
jae 0x4028cb
push 1
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edx, dword [ebp - 0x640]
push edx
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
jmp 0x4028ef
xor eax, eax
test eax, eax
jne 0x4028ef
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx + 0xc]
cmp edx, dword [ebp - 0x640]
jae 0x4028ef
mov eax, dword [ebp - 0x640]
push eax
mov ecx, dword [ebp + 0x28]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov byte [ebp - 0x64c], 1
mov ecx, dword [ebp - 0x64c]
and ecx, 0xff
test ecx, ecx
je 0x40296a
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
mov ecx, dword [ebp + 0x28]
add eax, dword [ecx + 8]
mov dword [ebp - 0x650], eax
mov ecx, dword [ebp - 0x65c]
mov esi, 0x43b080
mov edi, dword [ebp - 0x650]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x654], 0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp - 0x640]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x28]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0x640]
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x658]
mov dl, byte [ebp - 0x654]
mov byte [ecx], dl
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret