Function at 0x44e9ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xb
add esp, 0xfffff004
push eax
dec eax
jne 0x44e9b5
mov eax, dword [ebp - 4]
add esp, 0xfffff9c0
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4b99b8
mov eax, 0x4a7e64
call fcn.004980b0
mov eax, dword [esi + 8]
test eax, eax
je 0x44ea3d
push eax
call sub.KERNEL32.DLL_GlobalSize
mov edi, eax
push edi
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x44ea10
xor eax, eax
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
jmp 0x4501ec
push ebx
call sub.KERNEL32.DLL_GlobalLock
push edi
push dword [esi + 8]
push eax
call fcn.00497a90
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, ebx
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
jmp 0x4501ec
mov edx, 0x4c86ac
mov eax, 0x4a7c7c
call fcn.00463a04
test al, al
jne 0x44ea64
xor eax, eax
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
jmp 0x4501ec
lea ecx, [ebp - 0x9990]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x4c86ac
call fcn.00499610
pop ecx
call fcn.00486b94
mov dword [ebp - 0x9584], eax
mov word [ebp - 0x9570], 0x14
mov eax, dword [edi]
mov dword [ebp - 0x4b14], eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x4b10], edx
mov cl, byte [edi + 8]
mov byte [ebp - 0x4b0c], cl
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x4b08], eax
push esi
push edi
lea esi, [edi + 0x10]
lea edi, [ebp - 0x4b04]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x410]
lea edi, [ebp - 0x4704]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x810]
lea edi, [ebp - 0x4304]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0xc10]
lea edi, [ebp - 0x3f04]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1410]
lea edi, [ebp - 0x3704]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x1810]
mov dword [ebp - 0x3304], eax
mov edx, dword [edi + 0x1814]
mov dword [ebp - 0x3300], edx
push esi
push edi
lea esi, [edi + 0x1818]
lea edi, [ebp - 0x32fc]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x1c18]
lea edi, [ebp - 0x2efc]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x1c98]
mov byte [ebp - 0x2e7c], al
push esi
push edi
lea esi, [edi + 0x1c99]
lea edi, [ebp - 0x2e7b]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x209c]
mov dword [ebp - 0x2a78], eax
mov dl, byte [edi + 0x20a0]
mov byte [ebp - 0x2a74], dl
mov ecx, dword [edi + 0x20a4]
mov dword [ebp - 0x2a70], ecx
mov eax, dword [edi + 0x20a8]
mov dword [ebp - 0x2a6c], eax
mov edx, dword [edi + 0x20ac]
mov dword [ebp - 0x2a68], edx
mov ecx, dword [edi + 0x20b0]
mov dword [ebp - 0x2a64], ecx
mov al, byte [edi + 0x20b4]
mov byte [ebp - 0x2a60], al
mov dl, byte [edi + 0x20b5]
mov byte [ebp - 0x2a5f], dl
mov cl, byte [edi + 0x20b6]
mov byte [ebp - 0x2a5e], cl
mov eax, dword [edi + 0x20b8]
mov dword [ebp - 0x2a5c], eax
mov edx, dword [edi + 0x20bc]
mov dword [ebp - 0x2a58], edx
mov cl, byte [edi + 0x20c0]
mov byte [ebp - 0x2a54], cl
mov al, byte [edi + 0x20c1]
mov byte [ebp - 0x2a53], al
mov dl, byte [edi + 0x20c2]
mov byte [ebp - 0x2a52], dl
mov cl, byte [edi + 0x20c3]
mov byte [ebp - 0x2a51], cl
mov al, byte [edi + 0x20c4]
mov byte [ebp - 0x2a50], al
mov dl, byte [edi + 0x20c5]
mov byte [ebp - 0x2a4f], dl
mov ecx, dword [edi + 0x20c8]
mov dword [ebp - 0x2a4c], ecx
mov eax, dword [edi + 0x20cc]
mov dword [ebp - 0x2a48], eax
mov edx, dword [edi + 0x20d0]
mov dword [ebp - 0x2a44], edx
mov edx, dword [edi + 0x20d4]
mov dword [ebp - 0x2a40], edx
mov ecx, dword [edi + 0x20d8]
mov dword [ebp - 0x2a3c], ecx
mov eax, dword [edi + 0x20dc]
mov dword [ebp - 0x2a38], eax
mov edx, dword [edi + 0x20e0]
mov dword [ebp - 0x2a34], edx
inc dword [ebp - 0x9564]
mov ecx, dword [edi + 0x20e4]
mov dword [ebp - 0x2a30], ecx
mov al, byte [edi + 0x20e8]
mov byte [ebp - 0x2a2c], al
mov dl, byte [edi + 0x20e9]
mov byte [ebp - 0x2a2b], dl
mov cl, byte [edi + 0x20ea]
mov byte [ebp - 0x2a2a], cl
mov eax, dword [edi + 0x20ec]
mov dword [ebp - 0x2a28], eax
mov edx, dword [edi + 0x20f0]
mov dword [ebp - 0x2a24], edx
mov cl, byte [edi + 0x20f4]
mov byte [ebp - 0x2a20], cl
mov al, byte [edi + 0x20f5]
mov byte [ebp - 0x2a1f], al
mov edx, dword [edi + 0x20f8]
mov dword [ebp - 0x2a1c], edx
mov ecx, dword [edi + 0x20fc]
mov dword [ebp - 0x2a18], ecx
mov al, byte [edi + 0x2100]
mov byte [ebp - 0x2a14], al
mov dl, byte [edi + 0x2101]
mov byte [ebp - 0x2a13], dl
mov cl, byte [edi + 0x2102]
mov byte [ebp - 0x2a12], cl
mov al, byte [edi + 0x2103]
mov byte [ebp - 0x2a11], al
mov dl, byte [edi + 0x2104]
mov byte [ebp - 0x2a10], dl
mov cl, byte [edi + 0x2105]
mov byte [ebp - 0x2a0f], cl
mov al, byte [edi + 0x2106]
mov byte [ebp - 0x2a0e], al
push esi
push edi
lea esi, [edi + 0x2107]
lea edi, [ebp - 0x2a0d]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x2157]
mov byte [ebp - 0x29bd], al
mov dl, byte [edi + 0x2158]
mov byte [ebp - 0x29bc], dl
mov cl, byte [edi + 0x2159]
mov byte [ebp - 0x29bb], cl
mov eax, dword [edi + 0x215c]
mov dword [ebp - 0x29b8], eax
mov edx, dword [edi + 0x2160]
mov dword [ebp - 0x29b4], edx
push esi
push edi
lea esi, [edi + 0x2164]
lea edi, [ebp - 0x29b0]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2188]
mov dword [ebp - 0x298c], eax
mov eax, dword [edi + 0x218c]
mov dword [ebp - 0x2988], eax
push esi
push edi
lea esi, [edi + 0x2190]
lea edi, [ebp - 0x2984]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x21b4]
mov dword [ebp - 0x2960], eax
mov eax, dword [edi + 0x21b8]
mov dword [ebp - 0x295c], eax
mov edx, dword [edi + 0x21bc]
mov dword [ebp - 0x2958], edx
mov edx, dword [edi + 0x21c0]
mov dword [ebp - 0x2954], edx
mov ecx, dword [edi + 0x21c4]
mov dword [ebp - 0x2950], ecx
mov ecx, dword [edi + 0x21c8]
mov dword [ebp - 0x294c], ecx
mov al, byte [edi + 0x21cc]
mov byte [ebp - 0x2948], al
mov dl, byte [edi + 0x21cd]
mov byte [ebp - 0x2947], dl
mov cl, byte [edi + 0x21ce]
mov byte [ebp - 0x2946], cl
mov al, byte [edi + 0x21cf]
mov byte [ebp - 0x2945], al
push esi
push edi
lea esi, [edi + 0x21d0]
lea edi, [ebp - 0x2944]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2290]
lea edi, [ebp - 0x2884]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2690]
mov dword [ebp - 0x2484], eax
mov dl, byte [edi + 0x2694]
mov byte [ebp - 0x2480], dl
mov cl, byte [edi + 0x2695]
mov byte [ebp - 0x247f], cl
mov al, byte [edi + 0x2696]
mov byte [ebp - 0x247e], al
mov edx, dword [edi + 0x2698]
mov dword [ebp - 0x247c], edx
mov ecx, dword [edi + 0x269c]
mov dword [ebp - 0x2478], ecx
mov eax, dword [edi + 0x26a0]
mov dword [ebp - 0x2474], eax
mov edx, dword [edi + 0x26a4]
mov dword [ebp - 0x2470], edx
push esi
push edi
lea esi, [edi + 0x26a8]
lea edi, [ebp - 0x246c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x2aa8]
mov dword [ebp - 0x206c], eax
mov dl, byte [edi + 0x2aac]
mov byte [ebp - 0x2068], dl
mov cl, byte [edi + 0x2aad]
mov byte [ebp - 0x2067], cl
mov al, byte [edi + 0x2aae]
mov byte [ebp - 0x2066], al
mov edx, dword [edi + 0x2ab0]
mov dword [ebp - 0x2064], edx
mov cl, byte [edi + 0x2ab4]
mov byte [ebp - 0x2060], cl
push esi
push edi
lea esi, [edi + 0x2ab5]
lea edi, [ebp - 0x205f]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x2eb5]
lea edi, [ebp - 0x1c5f]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [edi + 0x32b5]
mov byte [ebp - 0x185f], al
mov dl, byte [edi + 0x32b6]
mov byte [ebp - 0x185e], dl
mov cl, byte [edi + 0x32b7]
mov byte [ebp - 0x185d], cl
mov al, byte [edi + 0x32b8]
mov byte [ebp - 0x185c], al
mov edx, dword [edi + 0x32bc]
mov dword [ebp - 0x1858], edx
mov cl, byte [edi + 0x32c0]
mov byte [ebp - 0x1854], cl
mov al, byte [edi + 0x32c1]
mov byte [ebp - 0x1853], al
mov edx, dword [edi + 0x32c4]
mov dword [ebp - 0x1850], edx
mov cl, byte [edi + 0x32c8]
mov byte [ebp - 0x184c], cl
inc dword [ebp - 0x9564]
mov al, byte [edi + 0x32cc]
mov byte [ebp - 0x1848], al
mov dl, byte [edi + 0x32cd]
mov byte [ebp - 0x1847], dl
mov cl, byte [edi + 0x32ce]
mov byte [ebp - 0x1846], cl
mov ecx, 0x104
mov al, byte [edi + 0x32cf]
mov byte [ebp - 0x1845], al
push esi
push edi
lea esi, [edi + 0x32d0]
lea edi, [ebp - 0x1844]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x36e0]
lea edi, [ebp - 0x1434]
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x3f00]
lea edi, [ebp - 0xc14]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [edi + 0x4300]
lea edi, [ebp - 0x814]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [edi + 0x4b00]
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], eax
mov edx, dword [edi + 0x4b04]
mov dword [ebp - 0x10], edx
mov ecx, dword [edi + 0x4b08]
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x4b0c]
mov dword [ebp - 8], eax
lea eax, [edi + 0x20d8]
mov edx, dword [edi + 0x4b10]
mov dword [ebp - 4], edx
lea edx, [ebx + 0x20d8]
inc dword [ebp - 0x9564]
mov word [ebp - 0x9570], 8
call fcn.0040e128
lea ecx, [ebx + 0x2164]
mov dword [ebp - 0x9588], ecx
mov ecx, 9
mov eax, dword [ebp - 0x9588]
push esi
push edi
mov esi, eax
add edi, 0x2164
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x9588]
pop edi
pop esi
lea ecx, [ebx + 0x2190]
mov edx, dword [eax + 0x24]
mov dword [edi + 0x2188], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x218c], edx
mov dword [ebp - 0x958c], ecx
mov eax, dword [ebp - 0x958c]
push esi
push edi
mov esi, eax
add edi, 0x2190
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x958c]
pop edi
pop esi
mov edx, dword [eax + 0x24]
mov dword [edi + 0x21b4], edx
mov edx, dword [eax + 0x28]
mov dword [edi + 0x21b8], edx
mov ecx, dword [ebx]
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dl, byte [ebx + 8]
mov byte [edi + 8], dl
mov ecx, dword [ebx + 0xc]
mov dword [edi + 0xc], ecx
push esi
push edi
lea esi, [ebx + 0x10]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x410]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x810]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0xc10]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1410]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x1810]
pop esi
mov ecx, 0x100
mov dword [edi + 0x1810], eax
mov edx, dword [ebx + 0x1814]
mov dword [edi + 0x1814], edx
push esi
push edi
lea esi, [ebx + 0x1818]
add edi, 0x1818
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x1c18]
add edi, 0x1c18
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x1c98]
mov ecx, 0x100
mov byte [edi + 0x1c98], al
push esi
push edi
lea esi, [ebx + 0x1c99]
add edi, 0x1c99
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x209c]
mov dword [edi + 0x209c], eax
mov dl, byte [ebx + 0x20a0]
mov byte [edi + 0x20a0], dl
mov ecx, dword [ebx + 0x20a4]
mov dword [edi + 0x20a4], ecx
mov eax, dword [ebx + 0x20a8]
mov dword [edi + 0x20a8], eax
mov edx, dword [ebx + 0x20ac]
mov dword [edi + 0x20ac], edx
mov ecx, dword [ebx + 0x20b0]
mov dword [edi + 0x20b0], ecx
mov al, byte [ebx + 0x20b4]
mov byte [edi + 0x20b4], al
mov dl, byte [ebx + 0x20b5]
mov byte [edi + 0x20b5], dl
mov cl, byte [ebx + 0x20b6]
mov byte [edi + 0x20b6], cl
mov eax, dword [ebx + 0x20b8]
mov dword [edi + 0x20b8], eax
mov edx, dword [ebx + 0x20bc]
mov dword [edi + 0x20bc], edx
mov cl, byte [ebx + 0x20c0]
mov byte [edi + 0x20c0], cl
mov al, byte [ebx + 0x20c1]
mov byte [edi + 0x20c1], al
mov dl, byte [ebx + 0x20c2]
mov byte [edi + 0x20c2], dl
mov cl, byte [ebx + 0x20c3]
mov byte [edi + 0x20c3], cl
mov al, byte [ebx + 0x20c4]
mov byte [edi + 0x20c4], al
mov dl, byte [ebx + 0x20c5]
mov byte [edi + 0x20c5], dl
mov ecx, dword [ebx + 0x20c8]
mov dword [edi + 0x20c8], ecx
mov eax, dword [ebx + 0x20cc]
mov dword [edi + 0x20cc], eax
mov edx, dword [ebx + 0x20d0]
mov dword [edi + 0x20d0], edx
mov edx, dword [ebx + 0x20d4]
mov dword [edi + 0x20d4], edx
mov ecx, dword [ebx + 0x20e4]
mov dword [edi + 0x20e4], ecx
mov al, byte [ebx + 0x20e8]
mov byte [edi + 0x20e8], al
mov dl, byte [ebx + 0x20e9]
mov byte [edi + 0x20e9], dl
mov cl, byte [ebx + 0x20ea]
mov byte [edi + 0x20ea], cl
mov eax, dword [ebx + 0x20ec]
mov dword [edi + 0x20ec], eax
mov edx, dword [ebx + 0x20f0]
mov dword [edi + 0x20f0], edx
mov cl, byte [ebx + 0x20f4]
mov byte [edi + 0x20f4], cl
mov al, byte [ebx + 0x20f5]
mov byte [edi + 0x20f5], al
mov edx, dword [ebx + 0x20f8]
mov dword [edi + 0x20f8], edx
mov ecx, dword [ebx + 0x20fc]
mov dword [edi + 0x20fc], ecx
mov al, byte [ebx + 0x2100]
mov byte [edi + 0x2100], al
mov dl, byte [ebx + 0x2101]
mov byte [edi + 0x2101], dl
mov cl, byte [ebx + 0x2102]
mov byte [edi + 0x2102], cl
mov al, byte [ebx + 0x2103]
mov byte [edi + 0x2103], al
mov dl, byte [ebx + 0x2104]
mov byte [edi + 0x2104], dl
mov cl, byte [ebx + 0x2105]
mov byte [edi + 0x2105], cl
mov ecx, 0x14
mov al, byte [ebx + 0x2106]
mov byte [edi + 0x2106], al
push esi
push edi
lea esi, [ebx + 0x2107]
add edi, 0x2107
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebx + 0x2157]
mov byte [edi + 0x2157], al
mov dl, byte [ebx + 0x2158]
mov byte [edi + 0x2158], dl
mov cl, byte [ebx + 0x2159]
mov byte [edi + 0x2159], cl
mov eax, dword [ebx + 0x215c]
mov dword [edi + 0x215c], eax
mov edx, dword [ebx + 0x2160]
mov dword [edi + 0x2160], edx
mov ecx, dword [ebx + 0x21bc]
mov dword [edi + 0x21bc], ecx
mov ecx, dword [ebx + 0x21c0]
mov dword [edi + 0x21c0], ecx
mov eax, dword [ebx + 0x21c4]
mov dword [edi + 0x21c4], eax
mov eax, dword [ebx + 0x21c8]
mov dword [edi + 0x21c8], eax
mov dl, byte [ebx + 0x21cc]
mov byte [edi + 0x21cc], dl
mov cl, byte [ebx + 0x21cd]
mov byte [edi + 0x21cd], cl
mov ecx, 0x30
mov al, byte [ebx + 0x21ce]
mov byte [edi + 0x21ce], al
mov dl, byte [ebx + 0x21cf]
mov byte [edi + 0x21cf], dl
push esi
push edi
lea esi, [ebx + 0x21d0]
add edi, 0x21d0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2290]
add edi, 0x2290
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2690]
pop esi
mov dword [edi + 0x2690], eax
mov dl, byte [ebx + 0x2694]
mov byte [edi + 0x2694], dl
mov cl, byte [ebx + 0x2695]
mov byte [edi + 0x2695], cl
mov al, byte [ebx + 0x2696]
mov byte [edi + 0x2696], al
mov edx, dword [ebx + 0x2698]
mov dword [edi + 0x2698], edx
mov ecx, dword [ebx + 0x269c]
mov dword [edi + 0x269c], ecx
mov eax, dword [ebx + 0x26a0]
mov dword [edi + 0x26a0], eax
mov edx, dword [ebx + 0x26a4]
mov dword [edi + 0x26a4], edx
push esi
push edi
lea esi, [ebx + 0x26a8]
add edi, 0x26a8
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, dword [ebx + 0x2aa8]
pop esi
mov dword [edi + 0x2aa8], eax
mov dl, byte [ebx + 0x2aac]
mov byte [edi + 0x2aac], dl
mov cl, byte [ebx + 0x2aad]
mov byte [edi + 0x2aad], cl
mov al, byte [ebx + 0x2aae]
mov byte [edi + 0x2aae], al
mov edx, dword [ebx + 0x2ab0]
mov dword [edi + 0x2ab0], edx
mov cl, byte [ebx + 0x2ab4]
mov byte [edi + 0x2ab4], cl
push esi
push edi
lea esi, [ebx + 0x2ab5]
add edi, 0x2ab5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x2eb5]
add edi, 0x2eb5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
mov al, byte [ebx + 0x32b5]
pop esi
mov byte [edi + 0x32b5], al
mov dl, byte [ebx + 0x32b6]
mov byte [edi + 0x32b6], dl
mov cl, byte [ebx + 0x32b7]
mov byte [edi + 0x32b7], cl
mov al, byte [ebx + 0x32b8]
mov byte [edi + 0x32b8], al
mov edx, dword [ebx + 0x32bc]
mov dword [edi + 0x32bc], edx
mov cl, byte [ebx + 0x32c0]
mov byte [edi + 0x32c0], cl
mov al, byte [ebx + 0x32c1]
mov byte [edi + 0x32c1], al
mov edx, dword [ebx + 0x32c4]
mov dword [edi + 0x32c4], edx
mov cl, byte [ebx + 0x32c8]
mov byte [edi + 0x32c8], cl
mov al, byte [ebx + 0x32cc]
mov byte [edi + 0x32cc], al
mov dl, byte [ebx + 0x32cd]
mov byte [edi + 0x32cd], dl
mov cl, byte [ebx + 0x32ce]
mov byte [edi + 0x32ce], cl
mov ecx, 0x104
mov al, byte [ebx + 0x32cf]
mov byte [edi + 0x32cf], al
push esi
push edi
lea esi, [ebx + 0x32d0]
add edi, 0x32d0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x36e0]
add edi, 0x36e0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x3f00]
add edi, 0x3f00
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebx + 0x4300]
add edi, 0x4300
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebx + 0x4b00]
mov dword [edi + 0x4b00], eax
mov edx, dword [ebx + 0x4b04]
mov dword [edi + 0x4b04], edx
mov ecx, dword [ebx + 0x4b08]
mov dword [edi + 0x4b08], ecx
xor ecx, ecx
mov eax, dword [ebx + 0x4b0c]
mov dword [edi + 0x4b0c], eax
mov eax, 0x4c5bc4
mov edx, dword [ebx + 0x4b10]
mov dword [edi + 0x4b10], edx
xor edx, edx
call fcn.0045249c
lea edx, [ebp - 0x2a3c]
lea eax, [edi + 0x20d8]
call fcn.0040e128
push esi
push edi
lea esi, [ebp - 0x29b0]
add edi, 0x2164
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x298c]
mov dword [edi + 0x2188], eax
mov eax, dword [ebp - 0x2988]
mov dword [edi + 0x218c], eax
push esi
push edi
lea esi, [ebp - 0x2984]
add edi, 0x2190
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2960]
mov dword [edi + 0x21b4], eax
mov eax, dword [ebp - 0x295c]
mov dword [edi + 0x21b8], eax
mov edx, dword [ebp - 0x4b14]
mov dword [edi], edx
mov ecx, dword [ebp - 0x4b10]
mov dword [edi + 4], ecx
mov al, byte [ebp - 0x4b0c]
mov byte [edi + 8], al
mov edx, dword [ebp - 0x4b08]
mov dword [edi + 0xc], edx
push esi
push edi
lea esi, [ebp - 0x4b04]
add edi, 0x10
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x4704]
add edi, 0x410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x4304]
add edi, 0x810
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x3f04]
add edi, 0xc10
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x3704]
add edi, 0x1410
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x3304]
mov dword [edi + 0x1810], eax
mov edx, dword [ebp - 0x3300]
mov dword [edi + 0x1814], edx
push esi
push edi
lea esi, [ebp - 0x32fc]
add edi, 0x1818
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2efc]
add edi, 0x1c18
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x2e7c]
mov byte [edi + 0x1c98], al
push esi
push edi
lea esi, [ebp - 0x2e7b]
add edi, 0x1c99
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2a78]
mov dword [edi + 0x209c], eax
mov dl, byte [ebp - 0x2a74]
mov byte [edi + 0x20a0], dl
mov ecx, dword [ebp - 0x2a70]
mov dword [edi + 0x20a4], ecx
mov eax, dword [ebp - 0x2a6c]
mov dword [edi + 0x20a8], eax
mov edx, dword [ebp - 0x2a68]
mov dword [edi + 0x20ac], edx
mov ecx, dword [ebp - 0x2a64]
mov dword [edi + 0x20b0], ecx
mov al, byte [ebp - 0x2a60]
mov byte [edi + 0x20b4], al
mov dl, byte [ebp - 0x2a5f]
mov byte [edi + 0x20b5], dl
mov cl, byte [ebp - 0x2a5e]
mov byte [edi + 0x20b6], cl
mov eax, dword [ebp - 0x2a5c]
mov dword [edi + 0x20b8], eax
mov edx, dword [ebp - 0x2a58]
mov dword [edi + 0x20bc], edx
mov cl, byte [ebp - 0x2a54]
mov byte [edi + 0x20c0], cl
mov al, byte [ebp - 0x2a53]
mov byte [edi + 0x20c1], al
mov dl, byte [ebp - 0x2a52]
mov byte [edi + 0x20c2], dl
mov cl, byte [ebp - 0x2a51]
mov byte [edi + 0x20c3], cl
mov al, byte [ebp - 0x2a50]
mov byte [edi + 0x20c4], al
mov dl, byte [ebp - 0x2a4f]
mov byte [edi + 0x20c5], dl
mov ecx, dword [ebp - 0x2a4c]
mov dword [edi + 0x20c8], ecx
mov eax, dword [ebp - 0x2a48]
mov dword [edi + 0x20cc], eax
mov edx, dword [ebp - 0x2a44]
mov dword [edi + 0x20d0], edx
mov edx, dword [ebp - 0x2a40]
mov dword [edi + 0x20d4], edx
mov ecx, dword [ebp - 0x2a30]
mov dword [edi + 0x20e4], ecx
mov al, byte [ebp - 0x2a2c]
mov byte [edi + 0x20e8], al
mov dl, byte [ebp - 0x2a2b]
mov byte [edi + 0x20e9], dl
mov cl, byte [ebp - 0x2a2a]
mov byte [edi + 0x20ea], cl
mov eax, dword [ebp - 0x2a28]
mov dword [edi + 0x20ec], eax
mov edx, dword [ebp - 0x2a24]
mov dword [edi + 0x20f0], edx
mov cl, byte [ebp - 0x2a20]
mov byte [edi + 0x20f4], cl
mov al, byte [ebp - 0x2a1f]
mov byte [edi + 0x20f5], al
mov edx, dword [ebp - 0x2a1c]
mov dword [edi + 0x20f8], edx
mov ecx, dword [ebp - 0x2a18]
mov dword [edi + 0x20fc], ecx
mov al, byte [ebp - 0x2a14]
mov byte [edi + 0x2100], al
mov dl, byte [ebp - 0x2a13]
mov byte [edi + 0x2101], dl
mov cl, byte [ebp - 0x2a12]
mov byte [edi + 0x2102], cl
mov al, byte [ebp - 0x2a11]
mov byte [edi + 0x2103], al
mov dl, byte [ebp - 0x2a10]
mov byte [edi + 0x2104], dl
mov cl, byte [ebp - 0x2a0f]
mov byte [edi + 0x2105], cl
mov al, byte [ebp - 0x2a0e]
mov byte [edi + 0x2106], al
push esi
push edi
lea esi, [ebp - 0x2a0d]
add edi, 0x2107
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x29bd]
mov byte [edi + 0x2157], al
mov dl, byte [ebp - 0x29bc]
mov byte [edi + 0x2158], dl
mov cl, byte [ebp - 0x29bb]
mov byte [edi + 0x2159], cl
mov eax, dword [ebp - 0x29b8]
mov dword [edi + 0x215c], eax
mov edx, dword [ebp - 0x29b4]
mov dword [edi + 0x2160], edx
mov ecx, dword [ebp - 0x2958]
mov dword [edi + 0x21bc], ecx
mov ecx, dword [ebp - 0x2954]
mov dword [edi + 0x21c0], ecx
mov eax, dword [ebp - 0x2950]
mov dword [edi + 0x21c4], eax
mov eax, dword [ebp - 0x294c]
mov dword [edi + 0x21c8], eax
mov dl, byte [ebp - 0x2948]
mov byte [edi + 0x21cc], dl
mov cl, byte [ebp - 0x2947]
mov byte [edi + 0x21cd], cl
mov al, byte [ebp - 0x2946]
mov byte [edi + 0x21ce], al
mov dl, byte [ebp - 0x2945]
mov byte [edi + 0x21cf], dl
push esi
push edi
lea esi, [ebp - 0x2944]
add edi, 0x21d0
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x2884]
add edi, 0x2290
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x2484]
mov dword [edi + 0x2690], eax
mov dl, byte [ebp - 0x2480]
mov byte [edi + 0x2694], dl
mov cl, byte [ebp - 0x247f]
mov byte [edi + 0x2695], cl
mov al, byte [ebp - 0x247e]
mov byte [edi + 0x2696], al
mov edx, dword [ebp - 0x247c]
mov dword [edi + 0x2698], edx
mov ecx, dword [ebp - 0x2478]
mov dword [edi + 0x269c], ecx
mov eax, dword [ebp - 0x2474]
mov dword [edi + 0x26a0], eax
mov edx, dword [ebp - 0x2470]
mov dword [edi + 0x26a4], edx
push esi
push edi
lea esi, [ebp - 0x246c]
add edi, 0x26a8
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x206c]
mov dword [edi + 0x2aa8], eax
mov dl, byte [ebp - 0x2068]
mov byte [edi + 0x2aac], dl
mov cl, byte [ebp - 0x2067]
mov byte [edi + 0x2aad], cl
mov al, byte [ebp - 0x2066]
mov byte [edi + 0x2aae], al
mov edx, dword [ebp - 0x2064]
mov dword [edi + 0x2ab0], edx
mov cl, byte [ebp - 0x2060]
mov byte [edi + 0x2ab4], cl
push esi
push edi
lea esi, [ebp - 0x205f]
add edi, 0x2ab5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1c5f]
add edi, 0x2eb5
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp - 0x185f]
mov byte [edi + 0x32b5], al
mov dl, byte [ebp - 0x185e]
mov byte [edi + 0x32b6], dl
mov cl, byte [ebp - 0x185d]
mov byte [edi + 0x32b7], cl
mov al, byte [ebp - 0x185c]
mov byte [edi + 0x32b8], al
mov edx, dword [ebp - 0x1858]
mov dword [edi + 0x32bc], edx
mov cl, byte [ebp - 0x1854]
mov byte [edi + 0x32c0], cl
mov al, byte [ebp - 0x1853]
mov byte [edi + 0x32c1], al
mov edx, dword [ebp - 0x1850]
mov dword [edi + 0x32c4], edx
mov cl, byte [ebp - 0x184c]
mov byte [edi + 0x32c8], cl
mov al, byte [ebp - 0x1848]
mov byte [edi + 0x32cc], al
mov dl, byte [ebp - 0x1847]
mov byte [edi + 0x32cd], dl
mov cl, byte [ebp - 0x1846]
mov byte [edi + 0x32ce], cl
mov al, byte [ebp - 0x1845]
mov byte [edi + 0x32cf], al
push esi
push edi
lea esi, [ebp - 0x1844]
add edi, 0x32d0
mov ecx, 0x104
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x1434]
add edi, 0x36e0
mov ecx, 0x208
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0xc14]
add edi, 0x3f00
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea esi, [ebp - 0x814]
add edi, 0x4300
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x4b00], eax
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x4b04], edx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x4b08], ecx
mov eax, dword [ebp - 8]
mov dword [edi + 0x4b0c], eax
mov edx, dword [ebp - 4]
mov dword [edi + 0x4b10], edx
push 0x4b14
push 0
lea ecx, [ebp - 0x4b14]
push ecx
call fcn.00497b00
add esp, 0xc
call fcn.00486b94
cmp eax, dword [ebp - 0x9584]
jne 0x44fd8c
cmp dword [0x4c7818], 0
je 0x44fd90
xor eax, eax
jmp 0x44fd95
mov eax, 1
test al, al
jne 0x44fda0
mov byte [0x4c86aa], 0
lea edx, [ebp - 0x9d90]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.0045756c
cmp byte [ebp - 0x9d90], 0
je 0x44fdd9
lea edx, [ebp - 0x9d90]
lea eax, [ebp - 0x9d90]
call fcn.0040be38
lea edx, [ebp - 0x9d90]
push edx
call fcn.00499610
pop ecx
mov word [ebp - 0x9570], 0x20
lea eax, [ebp - 0x4c0c]
call fcn.0040fa70
add dword [ebp - 0x9564], 4
mov word [ebp - 0x9570], 8
mov word [ebp - 0x9570], 0x2c
mov word [ebp - 0x9570], 0x38
lea eax, [ebp - 0x4d04]
call fcn.0040fa70
add dword [ebp - 0x9564], 4
mov word [ebp - 0x9570], 0x44
mov edx, 0x4a7c89
lea eax, [ebp - 0x4d04]
call fcn.0040fbf4
lea eax, [ebp - 0xa230]
call fcn.00413d60
lea eax, [ebp - 0xa204]
call fcn.00413d60
lea eax, [ebp - 0xa1d8]
call fcn.00413d60
mov word [ebp - 0x9570], 0x50
push 0
push 3
lea edx, [ebp - 0x4d04]
lea eax, [ebp - 0x7130]
xor ecx, ecx
call fcn.00413298
inc dword [ebp - 0x9564]
mov word [ebp - 0x9570], 0x44
xor ebx, ebx
jmp 0x44fec4
lea edx, [ebp - 0xb244]
lea eax, [ebp - 0xae44]
call fcn.0040abcc
lea edx, [ebp - 0xb244]
lea eax, [ebp - 0x4c0c]
call fcn.0040fbf4
lea ecx, [ebp - 0xb244]
push ecx
call fcn.00497cb0
pop ecx
add eax, ebx
add eax, 3
mov ebx, eax
lea edx, [ebp - 0xae44]
lea eax, [ebp - 0x7130]
call fcn.004133cc
test eax, eax
je 0x44fe8e
test ebx, ebx
jne 0x44ff4e
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7130]
dec dword [ebp - 0x9564]
call fcn.00413370
sub dword [ebp - 0x9564], 4
lea eax, [ebp - 0x4d04]
mov edx, 2
call fcn.0040fb48
sub dword [ebp - 0x9564], 4
lea eax, [ebp - 0x4c0c]
mov edx, 2
call fcn.0040fb48
sub dword [ebp - 0x9564], 3
lea eax, [ebp - 0x4b14]
mov edx, 2
call fcn.004263e8
pop eax
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
jmp 0x4501ec
add ebx, 0x15
push ebx
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x9590], eax
cmp dword [ebp - 0x9590], 0
jne 0x44ffdc
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x7130]
dec dword [ebp - 0x9564]
call fcn.00413370
sub dword [ebp - 0x9564], 4
lea eax, [ebp - 0x4d04]
mov edx, 2
call fcn.0040fb48
sub dword [ebp - 0x9564], 4
lea eax, [ebp - 0x4c0c]
mov edx, 2
call fcn.0040fb48
sub dword [ebp - 0x9564], 3
lea eax, [ebp - 0x4b14]
mov edx, 2
call fcn.004263e8
pop eax
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
jmp 0x4501ec
lea eax, [ebp - 0x4d04]
call fcn.0040fdbc
mov word [ebp - 0x9570], 0x5c
push 0
push 1
lea edx, [ebp - 0x4d04]
lea eax, [ebp - 0x955c]
mov ecx, 1
call fcn.00413298
inc dword [ebp - 0x9564]
mov word [ebp - 0x9570], 0x44
jmp 0x45002d
test byte [ebp - 0xa23c], 5
je 0x45002d
mov byte [esi + 0x4f21], 0
jmp 0x450042
lea edx, [ebp - 0xae44]
lea eax, [ebp - 0x955c]
call fcn.004133cc
test eax, eax
je 0x45001b
dec dword [ebp - 0x9564]
lea eax, [ebp - 0x955c]
mov edx, 2
call fcn.00413370
dec dword [ebp - 0x9564]
lea eax, [ebp - 0x7130]
mov edx, 2
call fcn.00413370
sub dword [ebp - 0x9564], 4
lea eax, [ebp - 0x4d04]
mov edx, 2
call fcn.0040fb48
mov word [ebp - 0x9570], 0x2c
mov word [ebp - 0x9570], 8
jmp 0x4500f5
push dword [ebp - 0x9590]
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
mov word [ebp - 0x9570], 8
mov dword [edi], 0x14
xor eax, eax
mov dword [edi + 0x10], eax
mov ebx, 0x14
jmp 0x45013f
lea eax, [ebp - 0xb644]
push eax
lea edx, [ebx + edi]
push edx
call sub.KERNEL32.DLL_lstrcpyA
lea ecx, [ebp - 0xb644]
push ecx
call fcn.00497cb0
pop ecx
add eax, ebx
inc eax
mov ebx, eax
lea edx, [ebp - 0xb644]
lea eax, [ebp - 0x4c0c]
mov ecx, 0x400
call fcn.0040fc78
test al, al
jne 0x45011d
mov byte [edi + ebx], 0
lea eax, [ebp - 0x9990]
push eax
call fcn.00499610
pop ecx
push dword [ebp - 0x9590]
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov word [ebp - 0x9570], 8
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [esi + 8], eax
cmp dword [esi + 8], 0
je 0x45019e
push ebx
push edi
push dword [esi + 8]
call fcn.00497a90
add esp, 0xc
push dword [ebp - 0x9590]
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 0x9590]
mov edx, 2
push eax
lea eax, [ebp - 0x4c0c]
sub dword [ebp - 0x9564], 4
call fcn.0040fb48
sub dword [ebp - 0x9564], 3
lea eax, [ebp - 0x4b14]
mov edx, 2
call fcn.004263e8
pop eax
mov edx, dword [ebp - 0x9580]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret