Function at 0x44e7e5
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xfc
mov eax, dword [ebp + 0x78]
push ebx
xor ebx, ebx
cmp word [eax], 0x23
push esi
push edi
mov dword [ebp + 0x48], ecx
mov byte [ebp + 0x6f], bl
jne 0x44e80c
add dword [ebp + 0x78], 2
mov byte [ebp + 0x6f], 1
lea eax, [ebp + 0x78]
push eax
call fcn.00403c51
pop ecx
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x20]
call fcn.0042c415
lea ecx, [ebp + 0x44]
call fcn.0042c3f7
push esi
lea ecx, [ebp - 4]
call fcn.0042c415
push esi
lea ecx, [ebp + 0x24]
call fcn.0042c415
lea ecx, [ebp + 0x1c]
call fcn.0042c3f7
push 5
lea eax, [ebp + 0x78]
push eax
push str._find
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
call fcn.0042df66
add esp, 0xc
lea ecx, [ebp + 4]
mov byte [ebp + 0x37], al
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x6e], bl
call fcn.0042c3f7
lea ecx, [ebp - 8]
call fcn.0042c3f7
push 3
push dword [ebp + 0x78]
push 0x487ce0
call fcn.00427f14
add esp, 0xc
test al, al
je 0x44e913
add dword [ebp + 0x78], 6
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0042ed5c
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x40
pop ecx
pop ecx
jne 0x44e909
add dword [ebp + 0x78], 2
mov edi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x78]
mov dx, word [eax]
lea eax, [ebp + 0x78]
push eax
call fcn.00426ff7
cmp dx, bx
pop ecx
pop ecx
je 0x44e8eb
sub dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
mov word [eax], bx
add dword [ebp + 0x78], 2
mov ecx, dword [ebp + 0x48]
push esi
push ebx
lea eax, [ebp + 4]
push eax
push edi
call fcn.0043d4de
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 8
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00426ff7
pop ecx
mov ecx, dword [ebp + 0x48]
push esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x78]
call fcn.0043d4de
mov eax, dword [ebp - 8]
mov dword [ebp + 0x78], eax
push 4
lea eax, [ebp + 0x78]
push eax
push str._bin
call fcn.0042df66
add esp, 0xc
test al, al
je 0x44e945
mov byte [ebp + 0x6e], 1
mov eax, dword [ebp + 0x78]
mov si, word [eax]
mov ecx, dword [ebp + 0x48]
push ebx
push 0x2c
pop edi
push edi
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004242ef
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
jne 0x44e970
xor ebx, ebx
inc ebx
jmp 0x44f281
push ebx
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0042433c
mov eax, dword [ebp - 4]
add esp, 0x10
cmp word [eax], bx
je 0x44e968
mov ecx, dword [ebp + 0x48]
push ebx
push edi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004242ef
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
je 0x44e968
mov ecx, dword [ebp + 0x48]
push ebx
push edi
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.004242ef
cmp byte [ebp + 0x37], bl
je 0x44e9c3
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
je 0x44e968
lea ecx, [ebp - 0x1c]
call fcn.0042c281
cmp si, 0x22
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
je 0x44ea98
cmp byte [ebp + 0x6e], bl
jne 0x44ea98
push 0x23
push dword [ebp + 0x44]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x44ea98
cmp word [edi], 0x23
jne 0x44ea98
mov esi, dword [0x496dd4]
mov word [edi], bx
mov eax, dword [ebp + 0x44]
inc edi
inc edi
cmp word [eax], bx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x28], edi
je 0x44ea2b
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x30], 0x20
cmp word [edi], 0x2e
mov dword [ebp + 8], ebx
jne 0x44ea47
inc edi
inc edi
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x30], 0x40
xor eax, eax
mov ax, word [edi]
push eax
call fcn.0040ee76
add esp, 4
test al, al
je 0x44ea8a
cmp esi, ebx
je 0x44ea8a
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00433730
movzx ecx, byte [ebp + 0x30]
mov dword [ebp + 0x30], ecx
lea ecx, [ebp + 0x30]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp + 8]
push esi
call fcn.0040f211
add esp, 0x1c
mov byte [ebp + 0x6e], 2
cmp dword [ebp + 0x58], ebx
je 0x44ea98
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x44]
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x44], ebx
call fcn.0040ce49
pop ecx
push eax
lea ecx, [ebp + 0x44]
call fcn.00436246
lea ecx, [ebp + 0x18]
call fcn.0042704a
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], ebx
call fcn.0040ce49
pop ecx
push eax
lea ecx, [ebp + 0x1c]
call fcn.00436246
lea ecx, [ebp + 0x18]
call fcn.0042704a
mov eax, dword [ebp - 4]
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp], ebx
call fcn.0043066d
mov eax, dword [ebp + 0x78]
pop ecx
pop ecx
push 0x23
pop esi
or edi, 0xffffffff
cmp word [eax], si
jne 0x44ebd1
add dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x2a
jne 0x44eb2a
add dword [ebp + 0x78], 2
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x54], 0x7fffffff
jmp 0x44eb39
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043066d
pop ecx
pop ecx
mov eax, dword [ebp + 0x78]
cmp word [eax], si
jne 0x44ebd1
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043066d
test eax, eax
pop ecx
pop ecx
jle 0x44eb62
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], si
jne 0x44ebd1
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043066d
test eax, eax
pop ecx
pop ecx
jle 0x44eb87
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], si
jne 0x44ebd1
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043066d
test eax, eax
pop ecx
pop ecx
jle 0x44ebac
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x78]
cmp word [eax], si
jne 0x44ebd1
add dword [ebp + 0x78], 2
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043066d
test eax, eax
pop ecx
pop ecx
jle 0x44ebd1
mov eax, dword [ebp + 0x60]
mov dword [ebp], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00426ff7
cmp byte [ebp + 0x6e], bl
pop ecx
je 0x44ed44
mov esi, 0x4975e4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp + 0x4c]
call fcn.0042c3f7
xor ecx, ecx
xor eax, eax
cmp byte [ebp + 0x6e], 1
jne 0x44ec2f
mov ecx, dword [ebp + 0x48]
push ebx
lea eax, [ebp + 0x44]
push eax
call fcn.00402a5b
mov ecx, dword [ebp + 0x48]
push edi
push ebx
push dword [ebp + 0x44]
call fcn.0040af39
cmp eax, ebx
je 0x44ed31
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
and eax, 0x3fffffff
cmp byte [ebp + 0x6e], 2
jne 0x44ec3b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x3c]
cmp edx, eax
jle 0x44ec44
mov edx, eax
mov edi, dword [ebp + 0x50]
sub eax, edx
add ecx, edx
mov dword [ebp + 0x18], eax
cdq
cmp dword [ebp + 0x54], edx
mov dword [ebp + 0x58], ecx
jl 0x44ec60
jg 0x44ec5d
cmp edi, eax
jbe 0x44ec60
mov edi, dword [ebp + 0x18]
cmp byte [ebp + 0x6f], bl
je 0x44ec8b
push ebx
push ebx
push edi
push ecx
push dword [ebp + 0x24]
push dword [ebp + 0x48]
call fcn.0043a84b
add esp, 0x18
lea ecx, [ebp + 0x4c]
call fcn.0042704a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x44f279
cmp dword [ebp + 0x5c], ebx
lea ecx, [edi + edi*4 + 0xa]
jle 0x44eca6
mov eax, edi
cdq
idiv dword [ebp + 0x5c]
mov edx, dword [ebp + 0xc]
add edx, 2
inc eax
imul eax, edx
add ecx, eax
add ecx, 6
push ecx
lea ecx, [ebp + 0x4c]
call fcn.0042c43e
dec edi
mov esi, dword [ebp + 0x4c]
mov eax, esi
mov dword [ebp + 0x68], ebx
js 0x44ed29
inc edi
mov dword [ebp + 0x28], edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [ebp + 0x5c], ebx
jle 0x44ed06
mov eax, dword [ebp + 0x68]
cdq
idiv dword [ebp + 0x5c]
test edx, edx
jne 0x44ed06
cmp dword [ebp + 0x68], ebx
jle 0x44ecea
mov word [esi], 0xd
inc esi
inc esi
mov word [esi], 0xa
inc esi
inc esi
cmp dword [ebp + 0xc], ebx
je 0x44ed06
push dword [ebp + 4]
push dword [ebp + 0x68]
push str._8X_s
push esi
call edi
mov eax, dword [ebp + 0xc]
add esp, 0x10
lea esi, [esi + eax*2]
mov eax, dword [ebp + 0x58]
movzx eax, byte [eax]
push eax
push 0x4840d0
push esi
call edi
add esp, 0xc
inc dword [ebp + 0x58]
add esi, 0xa
inc dword [ebp + 0x68]
dec dword [ebp + 0x28]
lea eax, [esi - 2]
jne 0x44ecc7
mov word [eax], bx
mov esi, 0x4975e4
push dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x48]
push dword [ebp + 0x24]
call fcn.0042af0d
jmp 0x44ec77
push 0x3c
lea ecx, [ebp + 0x2c]
call fcn.0042c415
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x44]
push eax
mov dword [ebp + 0x10], ebx
call fcn.0043311b
cmp al, bl
pop ecx
pop ecx
mov byte [ebp + 0x4c], al
jge 0x44ed71
mov ebx, 0x80070057
jmp 0x44f271
push ebx
push ebx
push 3
push ebx
push 3
mov dword [ebp + 0x60], edi
mov dword [ebp + 0x64], edi
mov dword [ebp + 8], edi
mov edi, 0x80000000
push edi
push dword [ebp + 0x44]
lea ecx, [ebp + 0x38]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x30], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x38], ebx
call fcn.00403c6d
cmp byte [ebp + 0x4c], 0x11
jne 0x44edd7
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x38]
call fcn.00433047
add esp, 0xc
cmp edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jg 0x44ee05
jl 0x44edcf
cmp eax, ebx
jae 0x44ee05
xor ebx, ebx
inc ebx
jmp 0x44f251
cmp dword [ebp + 0x38], ebx
je 0x44ee05
cmp byte [ebp + 0x4c], bl
jne 0x44edf2
push 2
push ebx
push ebx
push dword [ebp + 0x38]
call fcn.00427e7e
add esp, 0x10
jmp 0x44edff
push dword [ebp + 0x4c]
push dword [ebp + 0x38]
call fcn.0042a40e
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
cmp byte [ebp + 0x37], bl
je 0x44ef1f
mov eax, dword [ebp + 0x1c]
or dword [ebp + 0x14], 0xffffffff
or dword [ebp + 0x18], 0xffffffff
xor esi, esi
cmp word [eax], 0x2a
mov dword [ebp + 0x5c], ebx
push ebx
jne 0x44ee48
lea ecx, [ebp + 0x28]
push ecx
mov ecx, dword [ebp + 0x48]
add eax, 2
push eax
call fcn.0043c875
mov eax, dword [ebp + 0x28]
push eax
mov dword [ebp + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
shl esi, 1
jmp 0x44ee97
push ebx
push 3
push ebx
push 3
push edi
push eax
lea ecx, [ebp + 0x30]
call fcn.00403c6d
cmp dword [ebp + 0x30], ebx
je 0x44ee97
push 2
push ebx
push ebx
push dword [ebp + 0x30]
call fcn.00427e7e
add esp, 0x10
cmp edx, ebx
jl 0x44ee80
mov ecx, 0x20000000
jg 0x44ee7b
cmp eax, ecx
jbe 0x44ee80
mov eax, ecx
mov dword [ebp - 0xc], ebx
push ebx
push ebx
mov esi, eax
push 2
cdq
push edx
push eax
push dword [ebp + 0x30]
lea ecx, [ebp - 0x28]
call fcn.0042c127
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x20]
cmp eax, ebx
jle 0x44eea3
add dword [ebp + 0x5c], eax
sub esi, eax
cmp dword [ebp + 0x68], ebx
jle 0x44eeb0
cmp esi, dword [ebp + 0x68]
jle 0x44eeb0
mov esi, dword [ebp + 0x68]
cmp dword [ebp + 0x38], ebx
je 0x44eef3
cmp dword [ebp + 0x5c], ebx
je 0x44eef3
cmp esi, ebx
jle 0x44eef3
cmp dword [ebp + 0x58], ebx
jl 0x44eef3
push dword [ebp]
push dword [ebp + 0x58]
push dword [ebp + 0x54]
push dword [ebp + 0x50]
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
push dword [ebp + 0x4c]
push esi
push dword [ebp + 0x5c]
push dword [ebp + 0x64]
push dword [ebp + 0x60]
push dword [ebp + 0x38]
call fcn.004332f7
add esp, 0x30
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], edx
push dword [ebp + 0x18]
lea eax, [ebp - 0x8c]
push dword [ebp + 0x14]
push eax
call fcn.00435e84
mov ecx, dword [ebp + 0x48]
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x24]
call fcn.0042af0d
jmp 0x44f251
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x18], ebx
je 0x44f1ec
cmp dword [ebp + 0x40], ebx
jl 0x44f1ec
mov esi, dword [ebp + 0x3c]
jg 0x44ef41
cmp esi, ebx
jb 0x44f1ec
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x40], eax
jg 0x44f1ec
jl 0x44ef58
cmp esi, dword [ebp + 0x60]
ja 0x44f1ec
cmp byte [ebp + 0x4c], bl
mov ecx, dword [ebp + 0x64]
jne 0x44ef75
cmp ecx, ebx
jl 0x44f224
jg 0x44ef89
cmp dword [ebp + 0x60], ebx
jbe 0x44f224
jmp 0x44ef89
cmp ecx, ebx
jg 0x44ef94
jl 0x44ef80
cmp dword [ebp + 0x60], ebx
jae 0x44ef89
or dword [ebp + 0x60], 0xffffffff
mov ecx, 0x7fffffff
cmp ecx, ebx
jl 0x44efb4
jg 0x44ef94
cmp dword [ebp + 0x60], ebx
jbe 0x44efb4
mov eax, dword [ebp + 0x60]
sub eax, esi
sbb ecx, dword [ebp + 0x40]
cmp ecx, dword [ebp + 0x54]
jg 0x44efb4
jl 0x44efa8
cmp eax, dword [ebp + 0x50]
jae 0x44efb4
mov eax, dword [ebp + 0x60]
sub eax, esi
cdq
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], edx
cmp dword [ebp + 0x5c], ebx
mov ecx, dword [ebp + 0x50]
lea edi, [ecx + ecx*4 + 0xa]
jle 0x44efd2
mov eax, ecx
cdq
idiv dword [ebp + 0x5c]
mov edx, dword [ebp + 0xc]
add edx, 2
inc eax
imul eax, edx
add edi, eax
cmp byte [ebp + 0x6f], bl
je 0x44efe1
lea eax, [ecx + 1]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
lea eax, [edi + 4]
push eax
lea ecx, [ebp + 0x2c]
call fcn.0042c43e
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x44edcf
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x78], eax
mov word [eax], bx
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x68], eax
je 0x44f016
mov ecx, dword [ebp + 0x50]
mov byte [ecx + eax], bl
mov eax, dword [ebp + 0x78]
mov word [eax + edi*2], bx
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
adc dword [ebp + 0x40], eax
cmp byte [ebp + 0x4c], bl
mov edi, dword [ebp + 0x40]
mov dword [ebp + 0x20], ebx
je 0x44f03a
push ebx
push 0x200
push edi
push esi
call fcn.0046e7f0
mov dword [ebp + 0x20], eax
movzx eax, word [ebp + 0x20]
cdq
sub esi, eax
push ebx
sbb edi, edx
push edi
push esi
push dword [ebp + 0x38]
call fcn.00427e7e
add esp, 0x10
push 0x100800
lea ecx, [ebp + 0x58]
call fcn.0042c29e
cmp dword [ebp + 0x54], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x10], ebx
jl 0x44f1a9
jle 0x44f1a0
movzx edi, word [ebp + 0x20]
mov esi, 0x100000
sub esi, edi
mov eax, esi
cdq
cmp edx, dword [ebp + 0x54]
jl 0x44f096
jg 0x44f093
cmp eax, dword [ebp + 0x50]
jbe 0x44f096
mov esi, dword [ebp + 0x50]
cmp byte [ebp + 0x4c], bl
lea eax, [esi + edi]
je 0x44f0ae
add eax, 0x1ff
cdq
mov ecx, 0x200
idiv ecx
shl eax, 9
push ebx
lea ecx, [ebp + 0x64]
push ecx
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x6f], bl
je 0x44f0e8
mov eax, dword [ebp + 0x58]
push esi
add eax, edi
push eax
push dword [ebp + 0x68]
call fcn.0046c720
add dword [ebp + 0x68], esi
mov eax, esi
cdq
add esp, 0xc
sub dword [ebp + 0x50], eax
sbb dword [ebp + 0x54], edx
jmp 0x44f192
dec esi
js 0x44f192
mov eax, dword [ebp + 0x58]
add edi, eax
inc esi
mov dword [ebp], esi
cmp dword [ebp + 0x5c], ebx
jle 0x44f15d
mov eax, dword [ebp + 0x5c]
cdq
push edx
push eax
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
call fcn.0046e7f0
or eax, edx
jne 0x44f15d
cmp dword [ebp + 0x40], ebx
jl 0x44f136
jg 0x44f11e
cmp dword [ebp + 0x3c], ebx
jbe 0x44f136
mov eax, dword [ebp + 0x78]
mov word [eax], 0xd
add dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
mov word [eax], 0xa
add dword [ebp + 0x78], 2
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x44f15d
push dword [ebp + 4]
push dword [ebp + 0x10]
push str._8X_s
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 0x78]
lea eax, [eax + esi*2]
add esp, 0x10
mov dword [ebp + 0x78], eax
movzx eax, byte [edi]
push eax
push 0x4840d0
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_wsprintfW]
add dword [ebp + 0x78], 0xa
add esp, 0xc
inc dword [ebp + 0x10]
add dword [ebp + 0x3c], 1
adc dword [ebp + 0x40], ebx
add dword [ebp + 0x50], 0xffffffff
adc dword [ebp + 0x54], 0xffffffff
inc edi
dec dword [ebp]
jne 0x44f0f8
cmp dword [ebp + 0x54], ebx
mov dword [ebp + 0x20], ebx
jg 0x44f079
jl 0x44f1a9
cmp dword [ebp + 0x50], ebx
ja 0x44f079
mov ecx, dword [ebp + 0x2c]
cmp dword [ebp + 0x78], ecx
je 0x44f1c7
cmp byte [ebp + 0x6f], bl
je 0x44f1bd
mov eax, dword [ebp + 0x68]
mov byte [eax], bl
jmp 0x44f1c7
sub dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
mov word [eax], bx
cmp byte [ebp + 0x6f], bl
je 0x44f1e2
mov eax, dword [ebp + 0x68]
push 4
push ebx
push dword [ebp + 0x68]
sub eax, ecx
mov dword [ebp + 8], eax
call fcn.0046c4e0
add esp, 0xc
lea ecx, [ebp + 0x58]
call fcn.0042704a
jmp 0x44f21f
cmp dword [ebp + 0x64], ebx
jg 0x44f207
jl 0x44f1f8
cmp dword [ebp + 0x60], ebx
jae 0x44f207
push str.0xFFFFFFFF
lea ecx, [ebp + 0x2c]
call fcn.00436246
jmp 0x44f218
push dword [ebp + 0x64]
push dword [ebp + 0x60]
push dword [ebp + 0x2c]
call fcn.00435e84
add esp, 0xc
mov dword [ebp + 0x18], 1
cmp dword [ebp + 8], ebx
jge 0x44f234
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x48]
push dword [ebp + 0x24]
call fcn.0042af0d
jmp 0x44f24e
push 1
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push dword [ebp + 0x48]
call fcn.0043a84b
add esp, 0x18
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp + 0x38]
call fcn.0040296e
lea ecx, [ebp + 0x30]
call fcn.0040296e
lea ecx, [ebp + 0x28]
call fcn.0042704a
lea ecx, [ebp - 0x28]
call fcn.00426f84
lea ecx, [ebp + 0x2c]
call fcn.0042704a
lea ecx, [ebp - 0x1c]
call fcn.0042704a
lea ecx, [ebp - 8]
call fcn.0042704a
lea ecx, [ebp + 4]
call fcn.0042704a
lea ecx, [ebp + 0x1c]
call fcn.0042704a
lea ecx, [ebp + 0x24]
call fcn.0042704a
lea ecx, [ebp - 4]
call fcn.0042704a
lea ecx, [ebp + 0x44]
call fcn.0042704a
lea ecx, [ebp - 0x20]
call fcn.0042704a
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8