Function at 0x48ba90
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50c
call 0x48ba9f
pop eax
mov esi, dword [edx + 0x50]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x520]
test esi, esi
mov dword [esp + 0xfc], eax
movzx eax, byte [edx + 0x54]
setne cl
or cl, al
cmp cl, 1
mov byte [esp + 0x32], cl
jne 0x48bcb9
test al, al
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe4], 0
jne 0x48bce3
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x48ee0f
cmp word [eax], 0
mov dword [esp], eax
je 0x48bcd2
mov esi, dword [esp]
jmp 0x48bb2c
cmp word [ebx], 0
mov esi, ebx
je 0x48bcd2
xor ecx, ecx
mov edx, 0xfffffffe
nop word cs:[eax + eax]
nop dword [eax]
mov ebp, ecx
mov eax, edx
inc ecx
add edx, 2
cmp word [esi + ebp*2], 0
jne 0x48bb40
lea ecx, [ebp + ebp]
cmp ebp, 1
lea ebx, [esi + ecx + 2]
je 0x48bb20
test ebp, ebp
je 0x48e6b4
xor edi, edi
nop word cs:[eax + eax]
cmp word [esi + edi*2 + 2], 0x3d
je 0x48bb80
inc edi
add eax, 0xfffffffe
jne 0x48bb70
jmp 0x48bb20
cmp edi, ebp
jae 0x48e6b4
lea eax, [edi + 1]
lea ecx, [esp + 0x80]
mov edx, esi
push eax
call fcn.00484c00
add esp, 4
add edi, 2
sub ebp, edi
jb 0x48e6b4
lea edx, [esi + edi*2]
lea ecx, [esp + 0x11c]
push ebp
call fcn.00484c00
add esp, 4
movsd xmm0, qword [esp + 0x80]
movq xmm2, qword [esp + 0x88]
lea eax, [esp + 0x11c]
movsd qword [esp + 0x10c], xmm0
movq qword [esp + 0x114], xmm2
mov esi, dword [esp + 0x10c]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov edi, dword [esp + 0x110]
mov eax, esi
movsd qword [esp + 0xc4], xmm0
movsd qword [esp + 0xcc], xmm1
neg eax
jo 0x48bcd2
movd eax, xmm2
lea ebp, [esp + 0x80]
lea ecx, [esp + 0x11c]
mov dword [esp + 0x80], edi
movdqu xmmword [esp + 0x4c], xmm2
add eax, edi
mov edx, ebp
mov dword [esp + 0x84], eax
mov word [esp + 0x88], 0
call fcn.0048eeb0
movups xmm0, xmmword [esp + 0x4c]
lea eax, [esp + 0xc4]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x110], edi
mov ecx, ebp
lea edx, [esp + 0xdc]
movlps qword [esp + 0x114], xmm0
push eax
lea eax, [esp + 0x110]
push eax
call fcn.0048f050
add esp, 8
test dword [esp + 0x80], 0x7fffffff
je 0x48bb20
push dword [esp + 0x84]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48bb20
xor ebp, ebp
mov dword [esp + 0xd4], esi
mov esi, dword [edx + 0x20]
test esi, esi
jne 0x48c4f6
jmp 0x48c547
push dword [esp]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 4]
mov eax, dword [edx + 0x48]
test esi, esi
setne cl
test eax, eax
setne dl
test dl, cl
je 0x48c373
mov ecx, dword [esp + 0x38]
xor edi, edi
mov edx, dword [ecx + 0x4c]
jmp 0x48bd26
push dword [esp + 0xc]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
dec esi
je 0x48c373
test edi, edi
je 0x48bd40
mov ecx, edx
movzx edx, word [edi + 0x1ea]
cmp ecx, edx
jae 0x48bd70
mov ebp, edi
jmp 0x48bd91
xor ecx, ecx
mov edi, eax
test edx, edx
je 0x48bd59
nop dword [eax + eax]
mov edi, dword [edi + 0x1ec]
dec edx
jne 0x48bd50
xor eax, eax
movzx edx, word [edi + 0x1ea]
cmp ecx, edx
jb 0x48bd37
nop word cs:[eax + eax]
mov ebp, dword [edi + 0xb0]
test ebp, ebp
je 0x48e6b4
movzx ecx, word [edi + 0x1e8]
inc eax
mov edi, ebp
cmp cx, word [ebp + 0x1ea]
jae 0x48bd70
test eax, eax
mov dword [esp + 4], esi
je 0x48bdc0
mov edi, dword [ebp + ecx*4 + 0x1f0]
mov dword [esp + 8], 0
dec eax
je 0x48bdc9
nop dword [eax + eax]
mov edi, dword [edi + 0x1ec]
dec eax
jne 0x48bdb0
jmp 0x48bdc9
lea eax, [ecx + 1]
mov edi, ebp
mov dword [esp + 8], eax
lea eax, [ecx + ecx*8]
lea eax, [eax + eax*2]
add eax, ecx
shl ecx, 4
lea esi, [ebp + eax + 0xb4]
xor eax, eax
cmp eax, dword [ebp + ecx]
jno 0x48beb0
mov eax, dword [esp + 0xdc]
test eax, eax
mov dword [esp + 0x18], eax
je 0x48bd15
mov edx, dword [esi + 0x18]
mov ecx, dword [esp + 0xe0]
mov eax, dword [esi + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xc], ecx
lea ecx, [edx + 0xb4]
mov dword [esp + 0x10], edx
movzx edx, word [edx + 0x1ea]
mov ebp, 0xffffffff
lea eax, [edx + edx*8]
mov dword [esp + 0x2c], edx
lea esi, [eax + eax*2]
add esi, edx
nop
test esi, esi
je 0x48be80
lea ebx, [ecx + 0x1c]
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [esp + 0xc]
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
inc ebp
add esi, 0xffffffe4
cmp eax, 3
mov ecx, ebx
je 0x48be40
cmp eax, 1
jne 0x48bef0
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x48be90
jmp 0x48bd15
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48bd15
mov edx, dword [esp + 0x10]
dec eax
mov dword [esp + 0xc], eax
mov edx, dword [edx + ebp*4 + 0x1ec]
jmp 0x48be1d
mov ebx, dword [esi + 8]
add ebp, ecx
test ebx, ebx
js 0x48e6b4
mov ecx, dword [esi + 4]
je 0x48c11c
movzx eax, byte [0xfd520d]
mov dword [esp + 0x4c], ecx
xor ecx, ecx
mov edx, ebx
call fcn.00494530
mov ecx, dword [esp + 0x4c]
test eax, eax
jne 0x48c121
jmp 0x48e6b4
mov edx, dword [esp + 0xc]
cmp eax, 2
jne 0x48ee0f
test edx, edx
mov byte [esp + 0x33], 0
je 0x48c276
mov eax, dword [esp + 0x10]
mov eax, dword [eax + ebp*4 + 0x1ec]
dec edx
je 0x48bf31
nop dword [eax + eax]
movzx ecx, word [eax + 0x1ea]
mov eax, dword [eax + ecx*4 + 0x1ec]
dec edx
jne 0x48bf20
movzx ecx, word [eax + 0x1ea]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], 0
lea eax, [esp + 0x33]
lea edx, [esp + 0xe8]
dec ecx
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 0x10c]
push eax
call fcn.004900a0
add esp, 4
mov eax, dword [esp + 0x124]
movsd xmm1, qword [esp + 0x114]
movsd xmm0, qword [esp + 0x11c]
movsd xmm3, qword [esp + 0x10c]
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x128]
movsd qword [esp + 0x64], xmm1
movsd qword [esp + 0x6c], xmm0
movsd qword [esp + 0x5c], xmm3
movq xmm2, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x138]
movq qword [esp + 0x1c], xmm2
movsd qword [esp + 0x24], xmm1
movzx edx, word [eax + 0x1ea]
cmp ecx, edx
jb 0x48bff6
nop word [eax + eax]
movzx ecx, word [eax + 0x1e8]
mov eax, dword [eax + 0xb0]
cmp cx, word [eax + 0x1ea]
jae 0x48bfe0
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
shl ecx, 4
mov esi, dword [eax + edx + 0xcc]
mov dword [esp + 0x98], esi
mov esi, dword [esp + 0x74]
movsd xmm0, qword [eax + edx + 0xc4]
movsd qword [esp + 0x90], xmm0
movsd xmm0, qword [eax + edx + 0xb4]
movsd xmm1, qword [eax + edx + 0xbc]
movsd qword [esp + 0x88], xmm1
movsd qword [esp + 0x80], xmm0
mov dword [eax + edx + 0xcc], esi
movsd xmm0, qword [esp + 0x6c]
movsd qword [eax + edx + 0xc4], xmm0
movsd xmm0, qword [esp + 0x5c]
movsd xmm1, qword [esp + 0x64]
movsd qword [eax + edx + 0xbc], xmm1
movsd qword [eax + edx + 0xb4], xmm0
lea edx, [esp + 0x9c]
movsd xmm0, qword [eax + ecx]
movsd xmm1, qword [eax + ecx + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
movsd xmm0, qword [esp + 0x1c]
movsd xmm1, qword [esp + 0x24]
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
movsd xmm1, qword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
movq xmm2, qword [esp + 0x98]
mov eax, dword [esp + 0xa8]
movsd qword [esp + 0x114], xmm1
movsd xmm1, qword [esp + 0x90]
movsd qword [esp + 0x10c], xmm0
movq qword [esp + 0x124], xmm2
mov dword [esp + 0x134], eax
movsd qword [esp + 0x11c], xmm1
movsd xmm1, qword [esp + 0xa0]
movsd qword [esp + 0x12c], xmm1
jmp 0x48c2ae
mov eax, 1
mov dword [esp + 0x4c], ebx
push ebx
push ecx
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [esi + 0x18]
test edx, edx
js 0x48e6b4
lea ebx, [edx + edx]
cmp ebx, 0x7fffffff
jae 0x48e6b4
movzx ecx, byte [esi + 0xc]
test ebx, ebx
mov byte [esp + 0xc], cl
mov ecx, dword [esi + 0x14]
je 0x48c184
movzx eax, byte [0xfd520d]
mov esi, edx
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov edx, ebx
call fcn.00494530
mov ecx, dword [esp + 0x2c]
test eax, eax
mov dword [esp + 0x10], esi
jne 0x48c193
jmp 0x48e6b4
mov eax, 2
mov dword [esp + 0x10], 0
mov esi, edx
push ebx
push ecx
push eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp]
movzx edx, byte [esp + 0xc]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x114], eax
mov byte [esp + 0x118], dl
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
js 0x48e6b4
mov esi, dword [ebp + 4]
je 0x48c20a
movzx eax, byte [0xfd520d]
xor ecx, ecx
mov edx, ebx
call fcn.00494530
test eax, eax
jne 0x48c20f
jmp 0x48e6b4
mov eax, 1
push ebx
push esi
push eax
mov esi, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, byte [ebp + 0xc]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], ebx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0xdc]
mov byte [esp + 0x8c], al
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x110]
push eax
call fcn.0048f050
add esp, 8
test dword [esp + 0x5c], 0x7fffffff
je 0x48bd15
push dword [esp + 0x60]
jmp 0x48bd07
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x33]
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], ebp
push eax
call fcn.004900a0
add esp, 4
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x12c]
dec dword [esp + 0xe4]
mov ebx, dword [esp + 0x10c]
mov ebp, dword [esp + 0x110]
mov esi, dword [esp + 0x11c]
cmp byte [esp + 0x33], 0
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0xd8]
mov dword [esp], eax
mov dword [esp + 0xc], ecx
je 0x48c332
test edx, edx
je 0x48e6b4
mov ecx, dword [esp + 0x18]
dec edx
mov eax, dword [ecx + 0x1ec]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], edx
mov dword [eax + 0xb0], 0
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg ebx
jo 0x48bd15
jae 0x48c34b
push ebp
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x48c360
push dword [esp]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test dword [esp + 0x4c], 0x7fffffff
je 0x48bd15
jmp 0x48bd03
mov eax, dword [esp + 0xe0]
mov edi, dword [esp + 0xdc]
mov esi, dword [esp + 0xe4]
xor ecx, ecx
mov edx, 4
xor ebp, ebp
mov dword [esp + 0xf4], eax
movzx eax, byte [0xfd520d]
call fcn.00494530
test eax, eax
je 0x48e6b4
mov ebx, eax
mov dword [eax], 0x48544150
add eax, 4
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x80]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov word [esp + 0x88], 0
call fcn.0048eeb0
mov eax, dword [esp + 0x120]
test edi, edi
mov dword [esp + 0xf8], edi
mov dword [esp + 0x4c], eax
je 0x48c4b9
mov ebp, dword [esp + 0x124]
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xc], ebx
mov dword [esp + 0xd4], esi
mov dword [esp + 4], eax
movzx edx, word [edi + 0x1ea]
lea ecx, [edi + 0xb4]
mov ebx, 0xffffffff
mov dword [esp], edi
lea eax, [edx + edx*8]
mov dword [esp + 8], edx
lea esi, [eax + eax*2]
add esi, edx
nop word [eax + eax]
test esi, esi
je 0x48c470
lea edi, [ecx + 0x1c]
push 1
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push ebp
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
inc ebx
add esi, 0xffffffe4
cmp eax, 3
mov ecx, edi
je 0x48c440
cmp eax, 1
jne 0x48c491
jmp 0x48c474
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
sub eax, 1
jb 0x48ca10
mov edi, dword [esp]
mov dword [esp + 4], eax
mov edi, dword [edi + ebx*4 + 0x1ec]
jmp 0x48c419
cmp eax, 2
jne 0x48ee0f
mov eax, dword [esp]
shl ebx, 4
mov esi, dword [esp + 0xd4]
mov ebp, dword [eax + ebx + 4]
mov eax, dword [eax + ebx + 8]
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0xc]
jmp 0x48c4b9
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x11c], 0
je 0x48c4e4
push dword [esp + 0x4c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x38]
mov dword [esp + 0xd4], esi
mov esi, dword [edx + 0x20]
test esi, esi
je 0x48c547
mov ecx, dword [edx + 0x1c]
mov eax, 0x490720
cmp esi, 4
mov edx, esi
jb 0x48c530
mov eax, dword [ecx]
mov esi, edx
mov edx, ecx
xor ecx, ecx
bswap eax
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
mov eax, 0x490720
adc ecx, 0xffffffff
mov ecx, 0x490710
cmove eax, ecx
mov ecx, edx
mov edx, esi
movzx ebx, byte [edx + ecx - 1]
push ebx
mov esi, ecx
mov edi, edx
call eax
add esp, 4
test al, al
je 0x48c5dc
mov byte [esp + 0xc8], 2
mov dword [esp + 0xcc], 0xf94e4c
mov ecx, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
mov eax, dword [esp + 0x48]
cmp byte [esp + 0x32], 0
mov dword [eax + 4], ebx
mov dword [eax], ecx
mov dword [eax + 8], 2
je 0x48edd9
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x48c673
mov ecx, dword [esp + 0xf4]
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], ecx
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], ecx
mov ecx, dword [esp + 0xd4]
mov eax, 1
jmp 0x48c677
lea eax, [esi + edi]
cmp edi, 3
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x78], eax
jbe 0x48c71d
movzx eax, byte [eax - 4]
mov ebp, edi
mov ecx, eax
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
xor eax, eax
cmp cl, 0x2e
mov ecx, 0
jne 0x48c760
mov esi, dword [esp + 0x78]
movzx ecx, byte [esi - 3]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x48c750
movzx ecx, byte [esi - 2]
mov edx, ecx
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x48c754
mov ecx, ebx
add cl, 0xbf
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, bl
cmp cl, 0x65
sete cl
jmp 0x48c760
xor eax, eax
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x12c], ecx
nop word cs:[eax + eax]
nop dword [eax]
lea ecx, [esp + 0x80]
lea edx, [esp + 0x10c]
call fcn.00491780
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x48edd9
mov esi, dword [esp + 0x88]
lea eax, [esi + esi*8]
lea eax, [eax + eax*2]
add eax, esi
cmp dword [ebp + eax + 0xb4], 0
lea edi, [ebp + eax + 0xb4]
je 0x48c6ef
push dword [edi + 4]
push 0
push dword [0xfd5200]
call ebx
cmp dword [edi + 0x10], 0
je 0x48c702
push dword [edi + 0x14]
push 0
push dword [0xfd5200]
call ebx
shl esi, 4
cmp dword [ebp + esi], 0
je 0x48c6a0
add ebp, esi
push dword [ebp + 4]
push 0
push dword [0xfd5200]
call ebx
jmp 0x48c6a0
mov ebp, edi
mov eax, edi
mov ecx, esi
nop word cs:[eax + eax]
nop dword [eax]
test eax, eax
je 0x48c8a5
movzx edx, byte [ecx]
cmp edx, 0x2f
je 0x48c7d0
inc ecx
dec eax
cmp edx, 0x5c
jne 0x48c730
jmp 0x48c7d0
xor ecx, ecx
jmp 0x48c760
xor ecx, ecx
nop word cs:[eax + eax]
cmp ebp, eax
je 0x48c8a5
mov edx, dword [esp + 0x14]
movzx edx, byte [edx + eax]
cmp edx, 0x5c
je 0x48c77b
inc eax
cmp edx, 0x2f
jne 0x48c760
test cl, cl
je 0x48c7d0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push ebp
call fcn.00485be0
add esp, 4
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x88]
jno 0x48c9e3
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xc4], 0x80000000
jmp 0x48d1b0
test ebp, ebp
js 0x48e6b4
movzx eax, byte [0xfd520d]
mov edi, ebp
xor ecx, ecx
xor ebp, ebp
mov edx, edi
call fcn.00494530
test eax, eax
je 0x48e6b4
mov esi, eax
push edi
push dword [esp + 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x10c], edi
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], edi
mov dword [esp + 0x118], 0
lea ecx, [esp + 0x10c]
mov edx, 0xf94e58
push 4
call fcn.00486020
add esp, 4
mov esi, dword [esp + 0x110]
mov ebx, dword [esp + 0x10c]
mov edi, dword [esp + 0x114]
lea ecx, [esp + 0x80]
mov edx, esi
push edi
call fcn.00490740
add esp, 4
cmp ebp, dword [esp + 0x80]
jno 0x48c96b
mov ecx, esi
mov edx, edi
mov dword [esp + 0x4c], ebx
call fcn.0048b170
test eax, eax
je 0x48d115
mov ebx, edx
cmp edx, 2
jne 0x48c990
cmp word [eax], 0x2e2e
jne 0x48c990
mov edx, 2
xor ecx, ecx
jmp 0x48d0ee
mov eax, dword [esp + 0x14]
xor esi, esi
jmp 0x48c8bb
xor esi, esi
test cx, cx
je 0x48c950
mov cx, 1
test si, si
jne 0x48c8b0
cmp eax, dword [esp + 0x78]
je 0x48c9c1
movzx edx, byte [eax]
test dl, dl
js 0x48c8d8
inc eax
jmp 0x48c925
movzx ebx, byte [eax + 1]
mov esi, edx
and esi, 0x1f
and ebx, 0x3f
cmp dl, 0xdf
jbe 0x48c91b
movzx edi, byte [eax + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp dl, 0xf0
jb 0x48c92b
movzx edx, byte [eax + 3]
and esi, 7
shl edi, 6
add eax, 4
shl esi, 0x12
and edx, 0x3f
or edx, edi
or edx, esi
cmp edx, 0xffff
jbe 0x48c925
jmp 0x48c93d
shl esi, 6
add eax, 2
or esi, ebx
mov edx, esi
xor esi, esi
mov ecx, edx
jmp 0x48c8b2
shl esi, 0xc
add eax, 3
or edi, esi
mov edx, edi
cmp edx, 0xffff
jbe 0x48c925
and edx, 0x3ff
or edx, 0xdc00
mov esi, edx
jmp 0x48c8b2
mov dword [esp + 0xc8], 2
mov dword [esp + 0xcc], 0xf94e20
jmp 0x48c55a
mov eax, dword [esp + 0x88]
movsd xmm0, qword [esp + 0x80]
mov dword [esp + 0xcc], eax
movsd qword [esp + 0xc4], xmm0
jmp 0x48d19d
mov edx, ebx
nop word cs:[eax + eax]
nop dword [eax]
test edx, edx
je 0x48ca1e
mov ebp, edx
dec edx
cmp byte [eax + ebp - 1], 0x2e
jne 0x48c9a0
test edx, edx
je 0x48d0ea
mov ecx, eax
sub ebx, ebp
add ecx, ebp
jmp 0x48d0ee
cmp ebp, 7
mov dword [esp + 0x34], ebp
ja 0x48ca29
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp byte [eax], 0x2e
je 0x48ca41
inc eax
dec ecx
jne 0x48c9d0
mov dword [esp + 0x40], 0
jmp 0x48ca49
mov dword [esp + 0x10c], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0xc4]
lea edx, [esp + 0x10c]
mov dword [esp + 0x110], eax
call fcn.00490820
jmp 0x48d1b0
mov esi, dword [esp + 0xd4]
xor ebp, ebp
jmp 0x48c4b3
mov ecx, eax
mov edx, ebx
xor eax, eax
jmp 0x48d0ee
mov edx, dword [esp + 0x14]
mov ecx, 0x2e
push ebp
call fcn.0041a5a0
add esp, 4
mov dword [esp + 0x40], eax
jmp 0x48ca49
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x48d021
add dword [esp + 0x2c], ebp
mov cl, 1
mov dword [esp + 8], 0
nop word cs:[eax + eax]
nop dword [eax]
mov byte [esp], cl
xor edx, edx
xor ecx, ecx
mov edi, dword [esp + 8]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 2
mov dword [esp + 0x64], 0
mov dword [esp + 0x4c], 2
jmp 0x48caad
mov eax, dword [esp + 0x4c]
mov word [eax + edx*2], bx
inc edx
mov dword [esp + 0x64], edx
mov ebx, edi
mov dword [esp + 0x18], edx
test bx, bx
je 0x48cae0
nop dword [eax + eax]
mov dword [esp + 8], 0
xor edi, edi
cmp bx, 0x22
je 0x48cbc0
jmp 0x48cbe0
cmp ebp, dword [esp + 0x2c]
je 0x48cc20
movzx ebx, byte [ebp]
test bl, bl
js 0x48cb10
inc ebp
xor edi, edi
cmp bx, 0x22
je 0x48cbc0
jmp 0x48cbe0
movzx esi, byte [ebp + 1]
mov eax, ecx
mov ecx, ebx
and ecx, 0x1f
and esi, 0x3f
cmp bl, 0xdf
jbe 0x48cb59
movzx edx, byte [ebp + 2]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp bl, 0xf0
jb 0x48cb6f
movzx ebx, byte [ebp + 3]
and ecx, 7
shl edx, 6
add ebp, 4
shl ecx, 0x12
and ebx, 0x3f
or ebx, edx
or ebx, ecx
cmp ebx, 0xffff
ja 0x48cb81
mov edx, dword [esp + 0x18]
jmp 0x48cb63
shl ecx, 6
add ebp, 2
or ecx, esi
mov ebx, ecx
mov ecx, eax
xor edi, edi
cmp bx, 0x22
je 0x48cbc0
jmp 0x48cbe0
shl ecx, 0xc
add ebp, 3
or edx, ecx
mov ebx, edx
cmp ebx, 0xffff
jbe 0x48cb53
lea ecx, [ebx + 0xff0000]
and ebx, 0x3ff
or ebx, 0xdc00
shr ecx, 0xa
mov edx, ebx
or ecx, 0xd800
mov edi, ebx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
mov ecx, eax
cmp bx, 0x22
jne 0x48cbe0
nop word cs:[eax + eax]
nop dword [eax]
xor cl, 1
mov ebx, edi
test bx, bx
jne 0x48cac0
jmp 0x48cae0
mov esi, ecx
movzx ecx, bx
cmp ecx, 0x3b
mov ecx, esi
jne 0x48cbf5
test cl, 1
je 0x48d016
cmp edx, dword [esp + 0x5c]
jne 0x48caa0
lea ecx, [esp + 0x5c]
call fcn.004858e0
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x18]
mov ecx, esi
mov dword [esp + 0x4c], eax
jmp 0x48caa0
mov dword [esp + 0x44], 0
movzx ecx, byte [esp]
test edx, edx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
setne al
or cl, al
test cl, 1
je 0x48cc79
test edx, edx
js 0x48e6b4
mov esi, dword [esp + 0x60]
je 0x48cd88
movzx eax, byte [0xfd520d]
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.00494530
mov edx, dword [esp + 0x18]
test eax, eax
mov dword [esp + 4], eax
jne 0x48cd90
jmp 0x48e6b4
mov edx, 0x80000000
cmp dword [esp + 0x5c], 0
je 0x48cc9b
push dword [esp + 0x60]
push 0
push dword [0xfd5200]
mov esi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, esi
mov eax, edx
neg eax
jo 0x48d021
test ebx, ebx
je 0x48cd57
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x10c], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ecx
lea ecx, [esp + 0x10c]
push dword [esp + 0x34]
call fcn.004871d0
add esp, 4
cmp dword [esp + 0x40], 1
je 0x48ccfb
lea ecx, [esp + 0x10c]
call fcn.0048b280
mov ebp, dword [esp + 0x110]
lea ecx, [esp + 0x80]
mov edx, ebp
push dword [esp + 0x114]
call fcn.00490740
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x48cd33
push ebp
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x80]
mov eax, edx
neg eax
jno 0x48d0d7
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov ecx, eax
jmp 0x48ca70
mov eax, dword [esp + 0x44]
test edx, edx
mov dword [esp + 0x10], 0
mov ecx, eax
je 0x48ca70
push dword [esp + 4]
push 0
push dword [0xfd5200]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, ebx
jmp 0x48ca70
mov dword [esp + 4], 1
mov eax, dword [esp + 0x3c]
lea edi, [esi + edx*2]
xor ebx, ebx
mov dword [esp + 0x10], edi
and eax, 0xffffff00
inc eax
mov dword [esp + 0x3c], eax
xor eax, eax
jmp 0x48cde2
mov eax, dword [esp + 4]
mov edi, edx
lea esi, [ebp + ebx]
add ebx, eax
mov dword [esp + 4], eax
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ebx, esi
mov edx, edi
mov ebp, dword [esp + 0xc]
mov esi, dword [esp]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
test al, 1
je 0x48cdf0
movzx eax, word [esp + 0xd8]
jmp 0x48cdfe
cmp esi, edi
je 0x48cc7e
movzx eax, word [esi]
add esi, 2
mov ecx, eax
and ecx, 0xf800
cmp ecx, 0xd800
movzx ecx, ax
jne 0x48ce30
cmp ecx, 0xdbff
jbe 0x48ce50
mov dword [esp], esi
mov dword [esp + 0x4c], 0
jmp 0x48cede
cmp ecx, 0x80
mov dword [esp + 0x1c], 0
mov dword [esp], esi
jae 0x48ce90
mov ebp, 1
mov byte [esp + 0x1c], al
jmp 0x48ceb1
cmp esi, edi
je 0x48ced3
movzx ebp, word [esi]
add esi, 2
mov dword [esp + 0x18], edx
mov dl, 1
mov dword [esp], esi
mov dword [esp + 0x4c], edx
mov esi, ebp
add esi, 0x2000
movzx esi, si
cmp esi, 0xfbff
ja 0x48cfa6
mov edx, dword [esp + 0x18]
mov word [esp + 0xd8], bp
jmp 0x48cede
cmp ecx, 0x800
jae 0x48cec7
mov ecx, eax
and al, 0x3f
mov ebp, 2
shr ecx, 6
or al, 0x80
or cl, 0xc0
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], al
mov dword [esp + 0x4c], 0
mov eax, edx
sub eax, ebx
cmp eax, ebp
jae 0x48cdb0
jmp 0x48cf24
mov esi, edx
mov dword [esp + 0x4c], 0
jmp 0x48cef0
mov dword [esp + 0x4c], 0
mov dword [esp], edi
and dword [esp + 0x3c], 0xffffff00
mov esi, edx
mov dword [esp + 0x1c], 0
mov edx, ecx
shr ecx, 6
and al, 0x3f
mov ebp, 3
shr edx, 0xc
and cl, 0x3f
or al, 0x80
or dl, 0xe0
or cl, 0x80
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], al
mov edx, esi
mov eax, edx
sub eax, ebx
cmp eax, ebp
jae 0x48cdb0
mov esi, ebx
add esi, ebp
jb 0x48e6b4
lea edi, [edx + edx]
mov eax, 8
cmp edi, esi
cmovbe edi, esi
cmp edi, 9
cmovb edi, eax
test edi, edi
js 0x48e6b4
test edx, edx
je 0x48cf66
mov eax, dword [esp + 4]
mov dword [esp + 0x10c], eax
mov eax, 1
mov dword [esp + 0x114], edx
jmp 0x48cf68
xor eax, eax
mov dword [esp + 0x110], eax
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x80]
mov edx, 1
push eax
push edi
call fcn.0041c420
add esp, 8
cmp dword [esp + 0x80], 1
je 0x48e6b4
mov eax, dword [esp + 0x84]
jmp 0x48cdba
movzx ecx, bp
and eax, 0x3ff
mov esi, ebx
mov ebp, 4
mov dword [esp + 0x4c], 0
mov edx, ecx
shl eax, 0xa
and cl, 0x3f
and edx, 0x3c0
lea ebx, [eax + 0x10000]
or cl, 0x80
or edx, eax
mov eax, ebx
shr ebx, 0xc
shr edx, 6
shr eax, 0x12
and bl, 0x3f
and dl, 0x3f
or al, 0xf0
or bl, 0x80
or dl, 0x80
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], bl
mov ebx, esi
mov byte [esp + 0x1e], dl
mov edx, dword [esp + 0x18]
mov byte [esp + 0x1f], cl
mov eax, edx
sub eax, ebx
cmp eax, ebp
jb 0x48cf24
jmp 0x48cdb0
mov al, 1
mov dword [esp + 0x44], eax
jmp 0x48cc28
lea ecx, [esp + 0x80]
call fcn.00485ee0
mov ebx, dword [esp + 0x80]
mov eax, ebx
neg eax
jno 0x48d092
cmp byte [esp + 0x84], 3
jne 0x48df2e
mov esi, dword [esp + 0x88]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x48d060
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x48d07e
cmp dword [ebx + 8], 9
jb 0x48d06f
mov edi, dword [edi - 4]
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48df2e
mov esi, dword [esp + 0x84]
mov edi, dword [esp + 0x88]
mov ebp, dword [esp + 0x8c]
mov ecx, esi
mov edx, edi
call fcn.004882e0
test eax, eax
je 0x48dea5
test edx, edx
je 0x48dea3
cmp edi, edx
jbe 0x48de99
cmp byte [esi + edx], 0xbf
jg 0x48de9f
jmp 0x48e6b4
mov ecx, dword [esp + 0x84]
mov ebx, dword [esp + 0x88]
jmp 0x48d1cf
xor ecx, ecx
mov edx, ebx
test eax, eax
cmovne ecx, eax
test ecx, ecx
je 0x48d115
test eax, eax
cmove edx, ebx
add ecx, edx
sub ecx, esi
je 0x48d11b
mov ebx, dword [esp + 0x4c]
cmp edi, ecx
jbe 0x48d121
cmp byte [esi + ecx], 0xbf
jg 0x48d127
jmp 0x48e6b4
mov ebx, dword [esp + 0x4c]
jmp 0x48d12d
mov ebx, dword [esp + 0x4c]
jmp 0x48d12b
jne 0x48e6b4
cmp edi, ecx
jb 0x48d12d
mov edi, ecx
lea ecx, [esp + 0x10c]
mov edx, esi
push edi
call fcn.00485be0
add esp, 4
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x110]
mov ecx, edx
neg ecx
mov ecx, dword [esp + 0x114]
jno 0x48d175
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xc4], 0x80000000
jmp 0x48d19d
mov dword [esp + 0x10c], edx
mov dword [esp + 0x114], ecx
lea ecx, [esp + 0xc4]
lea edx, [esp + 0x10c]
mov dword [esp + 0x110], eax
call fcn.00490820
test ebx, ebx
je 0x48d1b0
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
mov eax, edx
neg eax
jo 0x48c568
cmp ebx, 5
mov dword [esp], edx
mov dword [esp + 0x4c], ecx
jb 0x48d1fa
mov eax, dword [esp + 0x4c]
lea eax, [eax + ebx*2]
mov ecx, eax
add ecx, 0xfffffff6
je 0x48d1fa
cmp word [ecx], 0x2e
jne 0x48d1fa
cmp word [eax - 2], 0
je 0x48db64
mov eax, dword [esp + 0x38]
lea esi, [esp + 0x80]
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 2
mov dword [esp + 0x88], 0
mov ecx, esi
mov ebx, dword [eax + 0x2c]
mov edi, dword [eax + 0x30]
movzx eax, byte [eax + 0x69]
mov byte [esp + 4], al
call fcn.004858e0
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x78]
mov word [eax], 0x22
mov dword [esp + 0x10c], edx
mov dword [esp + 0x110], ecx
lea edx, [esp + 0x10c]
mov ecx, esi
mov dword [esp + 0x88], 1
mov word [esp + 0x114], 0
call fcn.00485d20
mov esi, dword [esp + 0x88]
cmp esi, dword [esp + 0x80]
jne 0x48d29c
lea ecx, [esp + 0x80]
call fcn.004858e0
mov eax, dword [esp + 0x84]
mov word [eax + esi*2], 0x22
inc esi
test edi, edi
mov dword [esp + 0x88], esi
je 0x48d319
shl edi, 2
lea ebp, [edi + edi*4]
movzx edi, byte [esp + 4]
mov esi, dword [esp + 0x88]
cmp esi, dword [esp + 0x80]
jne 0x48d2dc
lea ecx, [esp + 0x80]
call fcn.004858e0
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x80]
mov word [eax + esi*2], 0x20
inc esi
mov dword [esp + 0x88], esi
push edi
push ebx
call fcn.004908e0
add esp, 8
cmp byte [esp + 0x5c], 4
jne 0x48d7ae
add ebx, 0x14
add ebp, 0xffffffec
jne 0x48d2c0
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov ecx, eax
neg ecx
jo 0x48d7d5
mov ecx, dword [esp]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov ebx, dword [esp + 0xd4]
cmp eax, esi
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], edi
mov dword [esp + 0xf0], esi
jne 0x48d382
lea ecx, [esp + 0xe8]
call fcn.004858e0
mov edi, dword [esp + 0xec]
mov ecx, dword [esp + 0x38]
mov word [edi + esi*2], 0
inc esi
mov eax, 0x608
mov edx, 0x400
mov dword [esp + 0xf0], esi
cmp byte [ecx + 0x68], 0
cmovne edx, eax
or edx, dword [ecx + 0x58]
cmp byte [esp + 0x32], 0
mov dword [esp + 0xd8], edx
je 0x48d810
mov eax, 2
test ebx, ebx
mov ecx, 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 4], 0
jne 0x48d407
lea ecx, [esp + 0x1c]
call fcn.004858e0
mov eax, dword [esp + 0x20]
mov ecx, 1
mov word [eax], 0
mov dword [esp + 0x24], 1
mov edx, dword [esp + 0xf8]
mov esi, dword [esp + 0xf4]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, ebx
test edx, edx
setne al
cmove ecx, edx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], edx
mov dword [esp + 0x118], esi
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], esi
mov dword [esp + 0x12c], ecx
lea ecx, [esp + 0x80]
lea edx, [esp + 0x10c]
call fcn.00491780
mov eax, dword [esp + 0x80]
test eax, eax
je 0x48e738
mov edx, dword [esp + 0x88]
lea ecx, [edx + edx*8]
lea ecx, [ecx + ecx*2]
add ecx, edx
mov edi, dword [eax + ecx + 0xb4]
mov esi, edi
neg esi
jo 0x48e738
mov dword [esp + 0x7c], edi
mov edi, dword [eax + ecx + 0xc4]
shl edx, 4
mov esi, dword [eax + ecx + 0xb8]
xor ebx, ebx
mov ebp, dword [eax + edx + 4]
mov dword [esp + 0x78], edi
mov edi, dword [eax + edx]
mov edx, dword [eax + edx + 8]
mov dword [esp + 0x44], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], edx
mov edx, dword [eax + ecx + 0xc8]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], edx
mov edx, dword [eax + ecx + 0xcc]
mov ecx, dword [eax + ecx + 0xbc]
mov dword [esp + 0x108], edx
add ecx, esi
mov edx, esi
jmp 0x48d51b
xor ebx, ebx
test si, si
je 0x48da34
mov si, 1
test bx, bx
jne 0x48d510
cmp edx, ecx
je 0x48d5a2
movzx eax, byte [edx]
test al, al
js 0x48d532
inc edx
jmp 0x48d599
movzx edi, byte [edx + 1]
mov ebp, eax
and ebp, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x48d56b
movzx ebx, byte [edx + 2]
shl edi, 6
and ebx, 0x3f
or ebx, edi
cmp al, 0xf0
jb 0x48d577
movzx eax, byte [edx + 3]
and ebp, 7
shl ebx, 6
add edx, 4
shl ebp, 0x12
and eax, 0x3f
or eax, ebx
or eax, ebp
jmp 0x48d581
shl ebp, 6
add edx, 2
or ebp, edi
mov eax, ebp
jmp 0x48d599
shl ebp, 0xc
add edx, 3
or ebx, ebp
mov eax, ebx
cmp eax, 0xffff
jbe 0x48d599
and eax, 0x3ff
or eax, 0xdc00
mov ebx, eax
jmp 0x48d512
xor ebx, ebx
mov esi, eax
jmp 0x48d512
cmp dword [esp + 0x7c], 0
je 0x48d5bb
push dword [esp + 0x44]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x108]
sub eax, edx
cmp eax, esi
jb 0x48d790
mov ecx, dword [esp + 0x18]
lea eax, [esi + esi]
mov ebp, esi
mov esi, ecx
lea ecx, [ecx + edx*2]
push eax
mov ebx, dword [esp + 0x18]
push ebx
push ecx
mov edi, edx
call sub.VCRUNTIME140.dll_memcpy
mov eax, edi
add esp, 0xc
add eax, ebp
cmp dword [esp + 0x78], 0
mov dword [esp + 0x24], eax
je 0x48d615
push ebx
push 0
push dword [0xfd5200]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
cmp eax, dword [esp + 0x1c]
jne 0x48d62c
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.004858e0
mov eax, esi
mov esi, dword [esp + 0x20]
mov word [esi + eax*2], 0x3d
inc eax
mov ecx, dword [esp + 0x34]
and dword [esp + 0x44], 0xffffff00
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
lea esi, [ecx + eax]
jmp 0x48d659
xor edi, edi
test dx, dx
je 0x48dced
mov dx, 1
test di, di
jne 0x48d64e
cmp ecx, esi
je 0x48d6e0
movzx eax, byte [ecx]
test al, al
js 0x48d670
inc ecx
jmp 0x48d6d7
movzx ebp, byte [ecx + 1]
mov edi, eax
and edi, 0x1f
and ebp, 0x3f
cmp al, 0xdf
jbe 0x48d6a9
movzx ebx, byte [ecx + 2]
shl ebp, 6
and ebx, 0x3f
or ebx, ebp
cmp al, 0xf0
jb 0x48d6b5
movzx eax, byte [ecx + 3]
and edi, 7
shl ebx, 6
add ecx, 4
shl edi, 0x12
and eax, 0x3f
or eax, ebx
or eax, edi
jmp 0x48d6bf
shl edi, 6
add ecx, 2
or edi, ebp
mov eax, edi
jmp 0x48d6d7
shl edi, 0xc
add ecx, 3
or ebx, edi
mov eax, ebx
cmp eax, 0xffff
jbe 0x48d6d7
and eax, 0x3ff
or eax, 0xdc00
mov edi, eax
jmp 0x48d650
xor edi, edi
mov edx, eax
jmp 0x48d650
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
mov eax, ecx
mov edx, edi
shr eax, 8
neg edx
mov dword [esp + 0x104], eax
jo 0x48ee16
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], esi
mov esi, ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x5c]
mov word [esp + 0x64], 0
call fcn.00485d20
test edi, edi
je 0x48d72f
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x80]
cmp edx, dword [esp + 0x1c]
jne 0x48d751
mov esi, ecx
lea ecx, [esp + 0x1c]
mov edi, edx
call fcn.004858e0
mov edx, edi
mov ecx, esi
mov eax, dword [esp + 0x20]
mov word [eax + edx*2], 0
inc edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
lea edx, [esp + 0x10c]
call fcn.00491780
mov eax, dword [esp + 0x80]
test eax, eax
jne 0x48d492
jmp 0x48e738
lea ecx, [esp + 0x1c]
push 2
push 2
push esi
call fcn.004ea1e0
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x48d5d8
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
cmp dword [esp + 0x80], 0
je 0x48d7d5
push dword [esp + 0x84]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp]
mov bl, 1
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 2
test edx, edx
je 0x48d801
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test byte [esp + 0x32], bl
jne 0x48c583
jmp 0x48edd9
xor edx, edx
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 2
xor eax, eax
mov dword [esp + 0x18], edx
cmp eax, dword [ecx + 0x34]
jno 0x48da96
mov dword [esp + 0x78], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x3c], 0
xorps xmm0, xmm0
mov cl, 1
xor eax, eax
movzx ebx, byte [esp + 0x524]
movups xmmword [esp + 0x1c], xmm0
lock cmpxchg byte [0xfd51f4], cl
jne 0x48e83e
test bl, bl
mov ebx, dword [esp + 0x38]
lea edi, [esp + 0xfc]
lea edx, [esp + 0xdc]
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0xdc], 2
lea ecx, [esp + 0x10c]
cmovne edx, edi
cmp dword [ebx], 6
mov ebp, dword [ebx + 8]
lea esi, [ebx + 0x10]
cmovne edx, ebx
cmp dword [ebx + 0x10], 6
cmove esi, edi
push eax
push 0xfffffffffffffff6
call fcn.00491900
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x48dcba
cmp ebp, 6
mov ebp, dword [esp + 0x110]
lea edx, [ebx + 8]
lea eax, [esp + 0x64]
lea ecx, [esp + 0x10c]
cmove edx, edi
push eax
push 0xfffffffffffffff5
call fcn.00491900
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x48ddea
mov edi, dword [esp + 0x110]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x10c]
mov edx, esi
push eax
push 0xfffffffffffffff4
call fcn.00491900
add esp, 8
movzx eax, byte [esp + 0x10c]
cmp al, 4
jne 0x48e6e8
mov ecx, dword [esp + 0x110]
xorps xmm0, xmm0
test ebp, ebp
mov dword [esp + 0xc0], 0
movups xmmword [esp + 0xb0], xmm0
movups xmmword [esp + 0xa0], xmm0
movups xmmword [esp + 0x90], xmm0
movups xmmword [esp + 0x80], xmm0
jne 0x48d989
test edi, edi
jne 0x48d989
mov eax, 1
test ecx, ecx
je 0x48d9ae
mov eax, 0x101
mov dword [esp + 0xac], pe_nt_image_headers32
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x44], ecx
cmp byte [edx + 0x44], 1
jne 0x48d9d6
movzx ecx, word [edx + 0x46]
mov dword [esp + 0xac], eax
mov word [esp + 0xb0], cx
mov esi, dword [edx + 0x64]
mov dword [esp + 0x7c], edi
test esi, esi
je 0x48eada
add edx, 0x5c
lea ecx, [esp + 0xc4]
mov dword [esp + 0x80], 0x48
call fcn.00491ed0
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
test byte [esp + 0xc4], 1
je 0x48eaf2
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 2
jmp 0x48ec32
cmp dword [esp + 0x7c], 0
je 0x48da4d
push dword [esp + 0x44]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x3c], 0
mov esi, dword [esp + 0x14]
je 0x48da6a
push dword [esp + 0x34]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
or dword [esp + 4], 2
cmp dword [esp + 0x78], 0
mov dword [esp + 0x2c], 0xf94e20
je 0x48dd23
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48dd23
mov edx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x3c]
xor edi, edi
add ecx, edx
mov dword [esp + 0x3c], edx
jmp 0x48dab1
xor edi, edi
test si, si
je 0x48db41
mov si, 1
test di, di
jne 0x48daa6
cmp edx, ecx
je 0x48de24
movzx ebx, byte [edx]
test bl, bl
js 0x48dacc
inc edx
jmp 0x48db38
movzx eax, byte [edx + 1]
mov edi, ebx
and edi, 0x1f
and eax, 0x3f
cmp bl, 0xdf
jbe 0x48db07
movzx ebp, byte [edx + 2]
shl eax, 6
and ebp, 0x3f
or ebp, eax
cmp bl, 0xf0
jb 0x48db13
movzx ebx, byte [edx + 3]
and edi, 7
shl ebp, 6
add edx, 4
shl edi, 0x12
and ebx, 0x3f
or ebx, ebp
or ebx, edi
jmp 0x48db1d
shl edi, 6
add edx, 2
or edi, eax
mov ebx, edi
jmp 0x48db38
shl edi, 0xc
add edx, 3
or ebp, edi
mov ebx, ebp
cmp ebx, 0xffff
jbe 0x48db38
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
jmp 0x48daa8
xor edi, edi
mov esi, ebx
jmp 0x48daa8
mov edi, dword [esp + 8]
mov esi, 0xf94e20
mov ecx, 2
mov eax, dword [esp + 0x48]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 2
jmp 0x48ecbb
movzx ecx, word [eax - 8]
lea edx, [ecx - 0x42]
cmp edx, 0x21
ja 0x48d1fa
mov esi, dword [esp + 0x7c]
add esi, dword [edx*4 + 0x48ee20]
jmp esi
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx edi, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
jmp 0x48ec54
cmp dword [esp + 0x3c], 0
mov esi, 2
mov dword [esp + 0x2c], 0xf94e20
je 0x48dd13
push dword [esp + 0x34]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x104]
shl eax, 8
or eax, esi
mov dword [esp + 4], eax
lea edi, [esp + 0x10c]
nop word [eax + eax]
lea ecx, [esp + 0x80]
mov edx, edi
call fcn.00491780
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x48ddb0
mov ebx, dword [esp + 0x88]
lea eax, [ebx + ebx*8]
lea eax, [eax + eax*2]
add eax, ebx
cmp dword [ebp + eax + 0xb4], 0
lea esi, [ebp + eax + 0xb4]
je 0x48dd7a
push dword [esi + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esi + 0x10], 0
je 0x48dd91
push dword [esi + 0x14]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
shl ebx, 4
cmp dword [ebp + ebx], 0
je 0x48dd30
add ebp, ebx
push dword [ebp + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48dd30
cmp dword [esp + 0x1c], 0
je 0x48ddc9
push dword [esp + 0x20]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 8]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 4]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], 2
jmp 0x48ecd4
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx edi, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
mov dword [edx + 8], 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48ec54
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x10c]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
lea ecx, [esp + 0x80]
mov word [esp + 0x114], 0
call fcn.0048eeb0
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 8]
cmp esi, edx
jne 0x48de7c
lea ecx, [esp + 0x80]
call fcn.004858e0
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
mov eax, edx
neg eax
mov word [ecx + esi*2], 0
jno 0x48e727
inc esi
jmp 0x48db4f
jne 0x48e6b4
cmp edi, edx
jb 0x48dea5
mov edi, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], edi
mov dword [esp + 0x118], ebp
lea ecx, [esp + 0x10c]
push dword [esp + 0x34]
call fcn.004871d0
add esp, 4
cmp dword [esp + 0x40], 1
je 0x48deeb
lea ecx, [esp + 0x10c]
call fcn.0048b280
mov esi, dword [esp + 0x110]
lea ecx, [esp + 0x5c]
mov edx, esi
push dword [esp + 0x114]
call fcn.00490740
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x48df20
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov eax, edx
neg eax
jno 0x48e2d6
mov ebx, 0x200
xor esi, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp], 2
cmp ebx, 0x201
jb 0x48df6e
jmp 0x48df90
jbe 0x48e012
cmp ebx, 0x201
jae 0x48df90
mov dword [esp + 0x4c], 0x200
lea ebp, [esp + 0x10c]
mov edi, ebx
jmp 0x48dfa1
sub ebx, esi
jne 0x48dff2
mov ebp, dword [esp]
mov edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test eax, eax
jne 0x48dfc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48e0c7
cmp ebx, edi
jne 0x48df60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48e6b4
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jae 0x48df90
jmp 0x48df6e
lea ecx, [esp + 0x1c]
mov edx, esi
push 2
push 2
push ebx
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp], eax
jmp 0x48df94
cmp ebx, dword [esp + 0x4c]
ja 0x48e6b4
lea edi, [esp + 0x80]
mov edx, ebp
mov ecx, edi
push ebx
call fcn.00484c00
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x34]
call fcn.004871d0
add esp, 4
cmp dword [esp + 0x40], 1
je 0x48e055
lea ecx, [esp + 0x80]
call fcn.0048b280
mov edi, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
mov edx, edi
push dword [esp + 0x88]
call fcn.00490740
add esp, 4
cmp dword [esp + 0x80], 0
je 0x48e08a
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0x1c], 0
je 0x48e0b7
push dword [esp + 0x20]
push 0
push dword [0xfd5200]
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, edi
mov ecx, esi
cmp edx, 0x80000001
jg 0x48d1cf
je 0x48e0ea
jmp 0x48e12d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x1c], 0
mov ebx, eax
je 0x48e0e8
push dword [esp + 0x20]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
cmp cl, 3
jne 0x48e12d
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x48e100
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x48e11e
cmp dword [edi + 8], 9
jb 0x48e10f
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, 0x200
xor esi, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 4], 2
cmp eax, 0x201
jb 0x48e17d
jmp 0x48e190
jbe 0x48e221
cmp eax, 0x201
jae 0x48e190
mov dword [esp + 0x4c], 0x200
lea ebx, [esp + 0x10c]
mov edi, eax
jmp 0x48e1a2
sub eax, esi
jne 0x48e1fd
mov ebx, dword [esp + 4]
mov edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call ebp
test eax, eax
jne 0x48e1d4
mov dword [esp], ebx
mov ebx, esi
mov esi, ebp
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp]
test ecx, ecx
jne 0x48e2e3
cmp eax, edi
jne 0x48e170
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48e6b4
lea eax, [edi + edi]
test edi, edi
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, 0x201
jae 0x48e190
jmp 0x48e17d
lea ecx, [esp + 0x1c]
mov edx, esi
push 2
push 2
push eax
call fcn.004ea1e0
add esp, 0xc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp + 4], eax
jmp 0x48e194
cmp eax, dword [esp + 0x4c]
ja 0x48e6b4
lea esi, [esp + 0x80]
mov edx, ebx
mov ecx, esi
push eax
call fcn.00484c00
add esp, 4
mov edx, dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x34]
call fcn.004871d0
add esp, 4
cmp dword [esp + 0x40], 1
je 0x48e264
lea ecx, [esp + 0x80]
call fcn.0048b280
mov esi, dword [esp + 0x84]
lea ecx, [esp + 0x5c]
mov edx, esi
push dword [esp + 0x88]
call fcn.00490740
add esp, 4
cmp dword [esp + 0x80], 0
je 0x48e299
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0x1c], 0
je 0x48e2c6
push dword [esp + 0x20]
push 0
push dword [0xfd5200]
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, edi
mov ecx, esi
cmp edx, 0x80000001
jg 0x48d1cf
je 0x48e306
jmp 0x48e349
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
jmp 0x48d1cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x1c], 0
mov ebx, eax
je 0x48e304
push dword [esp + 0x20]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
cmp cl, 3
jne 0x48e349
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov eax, dword [edi]
test eax, eax
je 0x48e31c
push esi
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x48e33a
cmp dword [edi + 8], 9
jb 0x48e32b
mov esi, dword [esi - 4]
push esi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [esp + 0x80]
mov edx, 0xf949c9
push 4
call fcn.00485960
add esp, 4
mov ecx, dword [esp + 0x80]
mov eax, ecx
neg eax
jo 0x48e662
mov esi, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
mov dword [esp + 0xc], ecx
mov byte [esp + 8], 1
mov dword [esp + 0x4c], 0
add edx, esi
mov dword [esp + 0x10], esi
mov dword [esp + 4], edx
jmp 0x48e3a3
mov edx, dword [esp + 4]
mov byte [esp + 8], bl
mov eax, 2
xor ebx, ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 2
mov dword [esp + 0x64], 0
mov dword [esp], 0
mov edi, ebp
test bp, bp
jne 0x48e3f0
jmp 0x48e410
mov ecx, dword [esp]
mov word [eax + ecx*2], di
inc ecx
mov dword [esp], ecx
mov dword [esp + 0x64], ecx
mov edi, ebp
test bp, bp
je 0x48e410
nop dword [eax]
mov dword [esp + 0x4c], 0
xor ebp, ebp
cmp di, 0x22
je 0x48e488
jmp 0x48e4d8
cmp esi, edx
je 0x48e50c
movzx ecx, byte [esi]
test cl, cl
js 0x48e430
inc esi
mov edi, ecx
xor ebp, ebp
cmp di, 0x22
je 0x48e488
jmp 0x48e4d8
movzx ebp, byte [esi + 1]
mov edi, ecx
and edi, 0x1f
and ebp, 0x3f
cmp cl, 0xdf
jbe 0x48e477
movzx edx, byte [esi + 2]
shl ebp, 6
and edx, 0x3f
or edx, ebp
cmp cl, 0xf0
jb 0x48e49b
movzx ecx, byte [esi + 3]
and edi, 7
shl edx, 6
add esi, 4
shl edi, 0x12
and ecx, 0x3f
or ecx, edx
or edi, ecx
mov edx, dword [esp + 4]
cmp edi, 0xffff
jbe 0x48e480
jmp 0x48e4af
shl edi, 6
add esi, 2
or edi, ebp
nop
xor ebp, ebp
cmp di, 0x22
jne 0x48e4d8
xor bl, 1
mov edi, ebp
test bp, bp
jne 0x48e3f0
jmp 0x48e410
shl edi, 0xc
add esi, 3
or edi, edx
mov edx, dword [esp + 4]
cmp edi, 0xffff
jbe 0x48e480
lea ecx, [edi + 0xff0000]
and edi, 0x3ff
shr ecx, 0xa
or edi, 0xdc00
or ecx, 0xd800
mov ebp, edi
mov edi, ecx
mov dword [esp + 0x4c], ebp
cmp di, 0x22
je 0x48e488
movzx ecx, di
cmp ecx, 0x3b
jne 0x48e4e9
test bl, 1
je 0x48e642
mov ecx, dword [esp]
cmp ecx, dword [esp + 0x5c]
jne 0x48e3d6
lea ecx, [esp + 0x5c]
call fcn.004858e0
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x60]
jmp 0x48e3d6
xor ebx, ebx
mov edi, dword [esp]
movzx ecx, byte [esp + 8]
test edi, edi
setne al
or cl, al
test cl, 1
je 0x48e538
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10c]
push edi
call fcn.00484c00
add esp, 4
jmp 0x48e543
mov dword [esp + 0x10c], 0x80000000
cmp dword [esp + 0x5c], 0
je 0x48e55c
push dword [esp + 0x60]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10c]
mov ecx, eax
neg ecx
jo 0x48e649
mov edx, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
test edx, edx
je 0x48e626
mov edi, dword [esp + 0x118]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], edx
mov edx, dword [esp + 0x14]
mov dword [esp], ebx
lea ecx, [esp + 0x10c]
mov dword [esp + 0x118], edi
push dword [esp + 0x34]
call fcn.004871d0
add esp, 4
cmp dword [esp + 0x40], 1
je 0x48e5d3
lea ecx, [esp + 0x10c]
call fcn.0048b280
mov ebx, dword [esp + 0x110]
lea ecx, [esp + 0x5c]
mov edx, ebx
push dword [esp + 0x114]
call fcn.00490740
add esp, 4
cmp dword [esp + 0x10c], 0
je 0x48e608
push ebx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x5c]
mov eax, edx
neg eax
jno 0x48e6b6
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov byte [esp + 8], al
jmp 0x48e3a3
test eax, eax
je 0x48e39b
push ecx
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48e39b
mov bl, 1
jmp 0x48e50e
cmp dword [esp + 0xc], 0
je 0x48e662
push dword [esp + 0x10]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [esp + 0xc8], 2
mov dword [esp + 0xcc], 0xf94e70
jmp 0x48c55a
ud2
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
cmp dword [esp + 0xc], 0
je 0x48d1cf
push dword [esp + 0x10]
push 0
push dword [0xfd5200]
mov esi, ecx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, edi
mov ecx, esi
jmp 0x48d1cf
movzx ecx, byte [esp + 0x10f]
mov edx, dword [esp + 0x48]
movzx ebx, word [esp + 0x10d]
mov esi, dword [esp + 0x110]
mov byte [edx + 3], cl
mov word [edx + 1], bx
mov byte [edx], al
mov dword [edx + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edx + 8], 2
push edi
call esi
push ebp
call esi
jmp 0x48ec54
mov dword [esp + 0x3c], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x78], ecx
jmp 0x48d849
lea edi, [esp + 0x10c]
lea ecx, [esp + 0x80]
mov edx, edi
call fcn.00491780
mov ebp, dword [esp + 0x80]
test ebp, ebp
je 0x48e7bf
mov ebx, dword [esp + 0x88]
lea eax, [ebx + ebx*8]
lea eax, [eax + eax*2]
add eax, ebx
cmp dword [ebp + eax + 0xb4], 0
lea esi, [ebp + eax + 0xb4]
je 0x48e789
push dword [esi + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esi + 0x10], 0
je 0x48e7a0
push dword [esi + 0x14]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
shl ebx, 4
cmp dword [ebp + ebx], 0
je 0x48e73f
add ebp, ebx
push dword [ebp + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48e73f
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
jne 0x48e7da
lea ecx, [esp + 0x1c]
call fcn.004858e0
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 8]
mov word [edx + esi*2], 0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
neg eax
jno 0x48d822
inc esi
mov dword [esp + 0x2c], esi
jmp 0x48ddcd
mov ecx, 0xfd51f4
call fcn.004e97a0
jmp 0x48d86b
mov dword [esp + 0x38], esi
mov dword [esp + 0x80], 0x44
lea edx, [esp + 0x80]
jmp 0x48eb22
mov eax, edx
lea edx, [esp + 0x10c]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ecx
lea esi, [esp + 0x80]
mov ecx, 0x11
or ebx, 0x80000
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov dword [esp + 0x150], eax
lea eax, [esp + 0x1c]
push eax
push edx
push dword [esp + 0x80]
push dword [esp + 0x24]
push ebx
push 1
push 0
push 0
push dword [esp + 0x10c]
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x48ebef
mov eax, dword [esp + 0x48]
movsd xmm1, qword [esp + 0x64]
movsd xmm0, qword [esp + 0x6c]
movsd xmm2, qword [esp + 0x5c]
cmp dword [esp + 0x38], 0
mov ebx, dword [esp + 0x44]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [esp + 0x1c]
movsd qword [eax + 0x18], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
je 0x48eb99
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.004920f0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [esp + 0x7c]
call esi
push ebp
call esi
cmp dword [esp + 0xdc], 4
jae 0x48ed36
xor eax, eax
xchg byte [0xfd51f4], al
cmp al, 2
jne 0x48ed53
push 0xfd51f4
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp dword [esp + 0x3c], 0
jne 0x48ed5a
jmp 0x48ed6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, word [esp + 0xc4]
mov edx, dword [esp + 0x48]
cmp dword [esp + 0x38], 0
mov edi, dword [esp + 0x44]
mov word [edx + 1], cx
mov ch, byte [esp + 0xc6]
mov byte [edx + 3], ch
mov byte [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], 2
je 0x48ec32
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.004920f0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov edi, dword [esp + 0xdc]
push dword [esp + 0x7c]
call esi
push ebp
call esi
cmp edi, 4
jae 0x48ed2a
cmp dword [esp + 0x5c], 0
je 0x48ec65
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x64], 0
mov edi, dword [esp + 8]
je 0x48ec7a
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x6c], 0
je 0x48ec8b
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xchg byte [0xfd51f4], al
cmp al, 2
jne 0x48eca2
push 0xfd51f4
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp dword [esp + 0x3c], 0
je 0x48ecbb
push dword [esp + 0x14]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x2c], 0
je 0x48ecd4
push dword [esp + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xe8], 0
je 0x48ecf3
push dword [esp + 0xec]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x48ed09
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [esp + 0x10], 0
je 0x48edd9
mov ecx, dword [esp + 0x4c]
xor ebx, ebx
mov edx, dword [esp]
test edx, edx
jne 0x48d7f2
jmp 0x48d801
push dword [esp + 0xe0]
jmp 0x48de19
push dword [esp + 0xe0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xchg byte [0xfd51f4], al
cmp al, 2
je 0x48ebc9
cmp dword [esp + 0x3c], 0
je 0x48ed6c
push dword [esp + 0x14]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0x2c], 0
je 0x48ed85
push dword [esp + 4]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xe8], 0
je 0x48eda4
push dword [esp + 0xec]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x48edba
push edi
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp], 0
setne al
test byte [esp + 0x10], al
je 0x48edd9
push dword [esp + 0x4c]
push 0
push dword [0xfd5200]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xfc], 4
jb 0x48edf0
push dword [esp + 0x100]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x50c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00485e80
ud2
movzx esi, cl
jmp 0x48dd13