Function at 0x6dfd00
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov dword [ebp - 8], 0x17
mov dword [ebp - 0xc], 0x14
mov dword [ebp - 0x4c], 0x22
mov dword [ebp - 0x94], 0x5c
mov dword [ebp - 0x2c], 0x4b
mov dword [ebp - 0x70], 0x2b
mov dword [ebp - 0x48], 0x45
mov dword [ebp - 0x3c], 0x63
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x34], 0x4d
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0x78], 0x64
mov dword [ebp - 0x38], 0x27
mov dword [ebp - 0x44], 0x27
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x40], 0x11
mov dword [ebp - 0x74], 0x49
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x14], 0x1c
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x1c], 0x62
mov dword [ebp - 0x24], 0x47
mov dword [ebp - 0x50], 0
jmp 0x6dfdbf
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x186a5
cmp dword [ebp - 0x50], ecx
jge 0x6dfdf0
push 0x68d2
push 0x2865
push 0xcacd
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
add esp, 0xc
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x6dfdb6
mov eax, dword [0x83b9bc]
sub eax, 1
mov dword [0x83b9bc], eax
mov ecx, dword [ebp + 8]
add ecx, 0x3cdb
and ecx, 0xfefb
xor ecx, 0xee3c
mov edx, 0x18c3
sub edx, dword [ebp + 0x1c]
or edx, 0x7089
xor edx, 0xfffff9ed
mov byte [edx + str.NRmlPPTAaCEDVTWTtZYnP], cl
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x74]
jge 0x6dfe40
mov dword [ebp - 0xa0], 1
jmp 0x6dfe4a
mov dword [ebp - 0xa0], 0
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x20]
jge 0x6dfe5e
mov dword [ebp - 0xa4], 1
jmp 0x6dfe68
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0xa0]
and edx, dword [ebp - 0xa4]
je 0x6dfe83
mov eax, dword [0x83ba40]
sub eax, 1
mov dword [0x83ba40], eax
mov dword [ebp - 0x54], 0
jmp 0x6dfe95
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x186eb
cmp dword [ebp - 0x54], edx
jge 0x6dff33
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x6dfebb
mov dword [ebp - 0xa8], 1
jmp 0x6dfec5
mov dword [ebp - 0xa8], 0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x40]
jge 0x6dfee2
mov dword [ebp - 0xac], 1
jmp 0x6dfeec
mov dword [ebp - 0xac], 0
mov eax, dword [0x83b9d8]
imul eax, dword [ebp - 0x70]
and eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
je 0x6dff2e
push 0x12679
push 0x8be7
push 0x16836
push 0x39bb
push 0x17572
call dword [sym.imp.KERNEL32.dll_GetACP]
add esp, 0x14
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x6dfe8c
mov edx, dword [ebp + 8]
xor edx, 0x65ed
xor edx, 0xd666
mov eax, dword [ebp + 0x10]
xor eax, 0x255e
sub eax, 0x24f4
xor eax, 0xffffff2f
mov byte [eax + str.NRmlPPTAaCEDVTWTtZYnP], dl
mov ecx, dword [0x83b9f8]
add ecx, 1
mov dword [0x83b9f8], ecx
mov edx, dword [ebp - 0x40]
cmp edx, dword [0x83b9f8]
jge 0x6dff80
mov dword [ebp - 0xb0], 1
jmp 0x6dff8a
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x128], eax
mov ecx, dword [0x83b994]
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x12c]
jge 0x6dffc2
mov dword [ebp - 0xb4], 1
jmp 0x6dffcc
mov dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 0xb0]
or ecx, dword [ebp - 0xb4]
je 0x6e011e
mov edx, dword [0x83b994]
cmp edx, dword [ebp - 0x34]
jge 0x6dfff5
mov dword [ebp - 0xb8], 1
jmp 0x6dffff
mov dword [ebp - 0xb8], 0
mov eax, dword [0x83b9bc]
imul eax, dword [0x83b9c0]
or eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 0x70]
or eax, ecx
mov dword [ebp - 0x130], eax
mov edx, dword [0x83b9bc]
add edx, 1
mov dword [0x83b9bc], edx
cmp dword [ebp - 0x130], 0
je 0x6e011e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x134], eax
mov ecx, dword [0x83b9fc]
mov dword [ebp - 0x138], ecx
mov edx, dword [0x83b9fc]
add edx, 1
mov dword [0x83b9fc], edx
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x138]
jge 0x6e0079
mov dword [ebp - 0xbc], 1
jmp 0x6e0083
mov dword [ebp - 0xbc], 0
mov ecx, dword [0x83ba40]
cmp ecx, dword [ebp - 0x38]
jge 0x6e009a
mov dword [ebp - 0xc0], 1
jmp 0x6e00a4
mov dword [ebp - 0xc0], 0
mov edx, dword [0x83b9f8]
and edx, dword [0x83b9d8]
or edx, dword [ebp - 0xbc]
or edx, dword [ebp - 0xc0]
je 0x6e011e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jge 0x6e00d2
mov dword [ebp - 0xc4], 1
jmp 0x6e00dc
mov dword [ebp - 0xc4], 0
mov ecx, dword [0x83b9f0]
cmp ecx, dword [ebp - 0x10]
jge 0x6e00f3
mov dword [ebp - 0xc8], 1
jmp 0x6e00fd
mov dword [ebp - 0xc8], 0
mov edx, dword [ebp - 0xc4]
and edx, dword [0x83b940]
xor edx, dword [ebp - 0xc8]
je 0x6e011e
mov eax, dword [0x83b940]
add eax, 1
mov dword [0x83b940], eax
mov dword [ebp - 0x58], 0
jmp 0x6e0130
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x186ad
cmp dword [ebp - 0x58], edx
jge 0x6e01c9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x83b994]
jge 0x6e0162
mov dword [ebp - 0xcc], 1
jmp 0x6e016c
mov dword [ebp - 0xcc], 0
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x2c]
cmp edx, dword [0x83b990]
jge 0x6e0186
mov dword [ebp - 0xd0], 1
jmp 0x6e0190
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [0x83b9bc]
and eax, dword [ebp - 0xcc]
or eax, dword [ebp - 0xd0]
je 0x6e01b6
mov ecx, dword [0x83b9fc]
sub ecx, 1
mov dword [0x83b9fc], ecx
push 0x63b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
add esp, 4
jmp 0x6e0127
mov dword [ebp - 0x5c], 0
jmp 0x6e01db
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [0x83b9dc]
sub eax, 0x186d2
cmp dword [ebp - 0x5c], eax
jge 0x6e023e
mov ecx, dword [0x83b93c]
sub ecx, 1
mov dword [0x83b93c], ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [0x83b93c]
test edx, edx
je 0x6e0210
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
push 0x6df0
push 0xda53
push 0x1235
push 0x1302
push 0x99ad
push 0x7b8b
push 0x1277f
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x1c
jmp 0x6e01d2
mov ecx, dword [0x83b9dc]
sub ecx, 4
push ecx
call fcn.0041dfb0
add esp, 4
mov edx, dword [0x83b9f8]
mov dword [ebp - 0x13c], edx
mov eax, dword [0x83b9fc]
mov dword [ebp - 0x140], eax
mov ecx, dword [0x83b9fc]
add ecx, 1
mov dword [0x83b9fc], ecx
mov edx, dword [ebp - 0x13c]
cmp edx, dword [ebp - 0x140]
jge 0x6e02cb
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
cmp ecx, dword [0x83b93c]
jge 0x6e02a7
mov dword [ebp - 0xd4], 1
jmp 0x6e02b1
mov dword [ebp - 0xd4], 0
mov edx, dword [ebp - 0x14]
add edx, dword [0x83b940]
and edx, dword [ebp - 0xd4]
je 0x6e02cb
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x60], 0
jmp 0x6e02dd
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x186a5
cmp dword [ebp - 0x60], edx
jge 0x6e032b
push 0x37db
push 0x8c7d
push 0x10ca5
push 0x18295
push 0x8f85
push 0xcad1
push 0xe9e4
push 0x6c11
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
add esp, 0x20
mov eax, dword [0x83b9f0]
sub eax, 1
mov dword [0x83b9f0], eax
jmp 0x6e02d4
mov ecx, dword [ebp + 0x20]
add ecx, 0x448
xor ecx, 0x2efb
mov edx, dword [ebp + 0x10]
xor edx, 0x6324
xor edx, 0x6246
mov byte [edx + str.NRmlPPTAaCEDVTWTtZYnP], cl
mov eax, dword [0x83b9dc]
add eax, 1
mov dword [0x83b9dc], eax
mov ecx, dword [0x83b9dc]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x144]
cmp ecx, dword [ebp - 0x148]
jge 0x6e0397
mov edx, dword [0x83b9d8]
sub edx, 1
mov dword [0x83b9d8], edx
mov eax, dword [ebp + 0x20]
xor eax, 0x2a5f
xor eax, 0x8535
add eax, 0x212b
xor eax, 0xa61b
mov ecx, 0x51ee
sub ecx, dword [ebp + 0xc]
sub ecx, 0xf275
xor ecx, 0xffff2974
mov byte [ecx + str.NRmlPPTAaCEDVTWTtZYnP], al
mov edx, dword [0x83b9fc]
sub edx, 0x12
push edx
mov eax, dword [0x83b9d8]
sub eax, 0x26
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0xd
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x35
push edx
mov eax, dword [0x83b9f0]
add eax, 0x4e
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x48
push ecx
call fcn.0041ce80
add esp, 0x18
mov dword [ebp - 0x64], 0
jmp 0x6e0413
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x40]
sub eax, 0x186b1
cmp dword [ebp - 0x64], eax
jge 0x6e045d
mov ecx, dword [0x83b9c4]
add ecx, 1
mov dword [0x83b9c4], ecx
push 0xdaf6
push 0x17709
push 0xe9e8
push 0x8425
push 0x14e94
push 0x17da5
push 0xa8f1
call dword [sym.imp.USER32.dll_SetWindowLongA]
add esp, 0x1c
jmp 0x6e040a
mov edx, dword [ebp + 0x20]
or edx, 0x3180
xor edx, 0x25ee
xor edx, 0x1e2c
mov eax, dword [ebp + 0x20]
sub eax, 0x6319
xor eax, 0xffffc705
mov byte [eax + str.NRmlPPTAaCEDVTWTtZYnP], dl
mov dword [ebp - 0x68], 0
jmp 0x6e0497
mov edx, dword [0x83b9c4]
sub edx, 0x186e3
cmp dword [ebp - 0x68], edx
jge 0x6e04de
mov eax, dword [0x83b9f4]
add eax, 1
mov dword [0x83b9f4], eax
push 0xe179
push 0x47f3
push 0x8799
push 0xc204
push 0x111fa
push 0x524
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [0x83b9dc]
add ecx, 0x2f
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x39
push edx
mov eax, dword [0x83b9fc]
add eax, 0xd
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xb
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 3
push edx
call fcn.0041b9f0
add esp, 0x14
mov eax, dword [0x83b9fc]
sub eax, 1
mov dword [0x83b9fc], eax
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x44]
jge 0x6e0532
mov dword [ebp - 0xd8], 1
jmp 0x6e053c
mov dword [ebp - 0xd8], 0
mov edx, dword [ebp - 0x3c]
cmp edx, dword [0x83ba40]
jge 0x6e0553
mov dword [ebp - 0xdc], 1
jmp 0x6e055d
mov dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xd8]
or eax, dword [ebp - 0xdc]
je 0x6e0574
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x28]
add edx, 5
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x51
push eax
mov ecx, dword [0x83b9f0]
add ecx, 0x49
push ecx
mov edx, dword [0x83ba40]
sub edx, 0xf
push edx
mov eax, dword [0x83b994]
sub eax, 0xa
push eax
mov ecx, dword [0x83b9c4]
sub ecx, 0x25
push ecx
mov edx, dword [0x83b9f4]
add edx, 1
push edx
mov eax, dword [ebp - 0x2c]
add eax, 9
push eax
call fcn.00419760
add esp, 0x20
mov ecx, dword [0x83b990]
cmp ecx, dword [ebp - 0x10]
jge 0x6e05d9
mov dword [ebp - 0xe0], 1
jmp 0x6e05e3
mov dword [ebp - 0xe0], 0
mov edx, dword [ebp - 0x78]
cmp edx, dword [0x83b93c]
jge 0x6e05fa
mov dword [ebp - 0xe4], 1
jmp 0x6e0604
mov dword [ebp - 0xe4], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x40]
jge 0x6e0624
mov dword [ebp - 0xe8], 1
jmp 0x6e062e
mov dword [ebp - 0xe8], 0
mov edx, dword [ebp - 0xe0]
and edx, dword [ebp - 0xe4]
or edx, dword [ebp - 0xe8]
je 0x6e064b
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x83ba40]
sub ecx, 0x4f
push ecx
mov edx, dword [0x83b9dc]
add edx, 0x20
push edx
mov eax, dword [0x83b9d8]
add eax, 0x26
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x42
push edx
mov eax, dword [ebp - 0x34]
sub eax, 0x2f
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x45
push ecx
mov edx, dword [0x83b9f8]
add edx, 9
push edx
call fcn.00419760
add esp, 0x20
call fcn.0041fa50
mov eax, dword [ebp + 0x20]
add eax, 0x2ce9
or eax, 0xcb4
xor eax, 0x696e36c8
mov ecx, dword [ebp + 0x1c]
or ecx, 0xa925
xor ecx, 0xff6f
mov dword [ecx + str.NRmlPPTAaCEDVTWTtZYnP], eax
mov edx, dword [ebp - 0x10]
add edx, dword [0x83ba40]
cmp edx, dword [ebp - 0x18]
jge 0x6e06dc
mov dword [ebp - 0xec], 1
jmp 0x6e06e6
mov dword [ebp - 0xec], 0
mov eax, dword [0x83b994]
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x150]
jge 0x6e071d
mov dword [ebp - 0xf0], 1
jmp 0x6e0727
mov dword [ebp - 0xf0], 0
mov ecx, dword [ebp - 0xec]
or ecx, dword [ebp - 0xf0]
je 0x6e0744
mov edx, dword [0x83b9f4]
sub edx, 1
mov dword [0x83b9f4], edx
mov dword [ebp - 0x6c], 0
jmp 0x6e0756
mov eax, dword [ebp - 0x6c]
add eax, 1
mov dword [ebp - 0x6c], eax
mov ecx, dword [0x83ba40]
sub ecx, 0x186f9
cmp dword [ebp - 0x6c], ecx
jge 0x6e08d1
push 0x14cb7
push 0xdf78
push 0x16ff0
call dword [sym.imp.USER32.dll_KillTimer]
add esp, 0xc
mov edx, dword [ebp - 0x3c]
or edx, dword [0x83b9bc]
je 0x6e08cc
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x3c]
jge 0x6e07a6
mov dword [ebp - 0xf4], 1
jmp 0x6e07b0
mov dword [ebp - 0xf4], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x154], ecx
mov edx, dword [0x83b9f4]
mov dword [ebp - 0x158], edx
mov eax, dword [0x83b9f4]
add eax, 1
mov dword [0x83b9f4], eax
mov ecx, dword [ebp - 0x154]
cmp ecx, dword [ebp - 0x158]
jge 0x6e07ec
mov dword [ebp - 0xf8], 1
jmp 0x6e07f6
mov dword [ebp - 0xf8], 0
mov edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x18]
and edx, dword [ebp - 0xf4]
or edx, dword [ebp - 0xf8]
je 0x6e08cc
mov eax, dword [0x83b9bc]
cmp eax, dword [ebp - 0x18]
jge 0x6e0825
mov dword [ebp - 0xfc], 1
jmp 0x6e082f
mov dword [ebp - 0xfc], 0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
and edx, dword [ebp - 0xfc]
xor edx, dword [ebp - 0x34]
or ecx, edx
je 0x6e08cc
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x3c]
jge 0x6e0863
mov dword [ebp - 0x100], 1
jmp 0x6e086d
mov dword [ebp - 0x100], 0
mov ecx, dword [0x83b9f4]
sub ecx, 1
mov dword [0x83b9f4], ecx
mov edx, dword [0x83b9f4]
cmp edx, dword [ebp - 4]
jge 0x6e0893
mov dword [ebp - 0x104], 1
jmp 0x6e089d
mov dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x100]
and ecx, dword [ebp - 0x14]
and ecx, dword [0x83b9bc]
or ecx, dword [ebp - 0x104]
je 0x6e08cc
mov edx, dword [0x83b940]
sub edx, 1
mov dword [0x83b940], edx
jmp 0x6e074d
mov eax, dword [ebp + 8]
or eax, 0xfe55
xor eax, 0xffee
mov ecx, 0x4ab3
sub ecx, dword [ebp + 8]
xor ecx, 0xffff9785
mov byte [ecx + str.NRmlPPTAaCEDVTWTtZYnP], al
mov edx, dword [0x83b93c]
sub edx, 0x2d
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0x26
push eax
call fcn.00428710
add esp, 8
mov ecx, dword [ebp - 0x44]
sub ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x2c
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0x11
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xe
push ecx
mov edx, dword [0x83b9d8]
sub edx, 0x2e
push edx
mov eax, dword [0x83b990]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
push ecx
mov edx, dword [0x83b9c4]
sub edx, 0x14
push edx
mov eax, dword [ebp - 0x70]
sub eax, 0xa
push eax
mov ecx, dword [0x83b9bc]
add ecx, 0x10
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x41
push edx
call fcn.00416420
add esp, 0x28
mov eax, dword [ebp - 0x74]
cmp eax, dword [0x83b9d8]
jge 0x6e0984
mov dword [ebp - 0x110], 1
jmp 0x6e098e
mov dword [ebp - 0x110], 0
mov ecx, dword [ebp - 0x78]
add ecx, dword [ebp - 0x40]
cmp ecx, dword [0x83b9c0]
jge 0x6e09a8
mov dword [ebp - 0x108], 1
jmp 0x6e09b2
mov dword [ebp - 0x108], 0
mov edx, dword [0x83b9f4]
or edx, dword [0x83b9f8]
cmp edx, dword [ebp - 0x20]
jge 0x6e09cf
mov dword [ebp - 0x10c], 1
jmp 0x6e09d9
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x108]
and eax, dword [ebp - 0x10c]
or eax, dword [ebp - 0x110]
je 0x6e0a07
mov ecx, dword [ebp - 0x78]
and ecx, dword [0x83b9c4]
je 0x6e0a07
mov edx, dword [0x83b994]
sub edx, 1
mov dword [0x83b994], edx
mov eax, dword [ebp + 0xc]
and eax, 0x37ee
xor eax, 0x778a
xor eax, 0x4260
mov ecx, dword [ebp + 8]
add ecx, 0xad77
xor ecx, 0xf417
add ecx, 0x593c
xor ecx, 0x1edb6
mov byte [ecx + str.NRmlPPTAaCEDVTWTtZYnP], al
call fcn.00426ba0
mov dword [ebp - 0x7c], 0
jmp 0x6e0a51
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [0x83b9c4]
sub eax, 0x42
cmp dword [ebp - 0x7c], eax
jge 0x6e0a6f
mov ecx, dword [0x83b9fc]
add ecx, 1
mov dword [0x83b9fc], ecx
jmp 0x6e0a48
mov edx, dword [ebp + 0x14]
and edx, 0xffffb67c
xor edx, 0x8435
mov eax, dword [ebp + 8]
and eax, 0x10c8d
sub eax, 0x59cf
xor eax, 0xffffa632
mov byte [eax + str.NRmlPPTAaCEDVTWTtZYnP], dl
call fcn.00426ba0
mov ecx, dword [ebp + 0x10]
and ecx, 0x63e5
xor ecx, 0x10d
mov edx, dword [ebp + 0x14]
and edx, 0xdc9d
xor edx, 0xc408
mov byte [edx + str.NRmlPPTAaCEDVTWTtZYnP], cl
mov dword [ebp - 0x80], 0
jmp 0x6e0ad1
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 4
cmp dword [ebp - 0x80], ecx
jge 0x6e0b28
mov edx, dword [0x83b9dc]
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [0x83b9dc]
add edx, 1
mov dword [0x83b9dc], edx
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x160]
jge 0x6e0b26
mov ecx, dword [0x83b9f4]
add ecx, 1
mov dword [0x83b9f4], ecx
jmp 0x6e0ac8
mov edx, dword [ebp - 0x28]
add edx, 0x4d
push edx
mov eax, dword [0x83b9f0]
add eax, 0x28
push eax
mov ecx, dword [0x83b994]
sub ecx, 0x38
push ecx
mov edx, dword [ebp - 0x4c]
add edx, 0x19
push edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x12
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x21
push ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x11
push edx
mov eax, dword [ebp - 0x4c]
add eax, 9
push eax
call fcn.004195b0
add esp, 0x20
mov dword [ebp - 0x84], 0
jmp 0x6e0b88
mov ecx, dword [ebp - 0x84]
add ecx, 1
mov dword [ebp - 0x84], ecx
mov edx, dword [0x83b9f0]
sub edx, 0x186b0
cmp dword [ebp - 0x84], edx
jge 0x6e0bd7
mov eax, dword [0x83b9f8]
add eax, 1
mov dword [0x83b9f8], eax
push 0xe253
push 0xe6af
push 0x282a
push 0x14794
push 0x9022
push 0x16a3f
push 0x14c7e
call dword [sym.imp.USER32.dll_SetWindowLongA]
add esp, 0x1c
jmp 0x6e0b79
mov ecx, 0x4918
sub ecx, dword [ebp + 0xc]
xor ecx, 0x2e747673
mov edx, dword [ebp + 0x10]
and edx, 0x7905
add edx, 0xf6aa
xor edx, 0xf7af
mov dword [edx + str.NRmlPPTAaCEDVTWTtZYnP], ecx
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
xor ecx, 0xc099
and ecx, 0x19c6
xor ecx, 0x133
mov edx, dword [ebp + 0xc]
xor edx, 0xc377
or edx, 0x19ea
xor edx, 0xffe1
mov byte [edx + str.NRmlPPTAaCEDVTWTtZYnP], cl
mov dword [ebp - 0x88], 0
jmp 0x6e0c54
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
mov ecx, dword [0x83b9bc]
sub ecx, 0x186dd
cmp dword [ebp - 0x88], ecx
jge 0x6e0c9a
push 0x16893
push 0x1019a
push 0xfcaa
push 0x138a6
push 0x11ad5
push 0x79bb
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x6e0c45
mov eax, dword [ebp + 0x20]
add eax, 0x2899
and eax, 0x589d
or eax, 0x4264
xor eax, 0x52ea
mov ecx, dword [ebp + 0x10]
and ecx, 0xb9ce
add ecx, 0xa6cc
xor ecx, 0xa801
mov byte [ecx + str.NRmlPPTAaCEDVTWTtZYnP], al
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x28]
jge 0x6e0ce0
mov dword [ebp - 0x114], 1
jmp 0x6e0cea
mov dword [ebp - 0x114], 0
mov eax, dword [0x83b9c4]
cmp eax, dword [0x83b9dc]
jge 0x6e0d03
mov dword [ebp - 0x118], 1
jmp 0x6e0d0d
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp - 0x114]
and ecx, dword [ebp - 0x118]
je 0x6e0d2a
mov edx, dword [0x83b9c4]
sub edx, 1
mov dword [0x83b9c4], edx
mov eax, dword [0x83b9c0]
sub eax, 1
mov dword [0x83b9c0], eax
mov ecx, dword [ebp + 0x20]
sub ecx, 0x37
xor ecx, 0x296b
mov edx, 0x5024
sub edx, dword [ebp + 0x18]
xor edx, 0x1a6d
mov byte [edx + str.NRmlPPTAaCEDVTWTtZYnP], cl
mov eax, dword [ebp - 8]
or eax, dword [0x83b9d8]
cmp eax, dword [0x83b9c4]
jge 0x6e0d74
mov dword [ebp - 0x11c], 1
jmp 0x6e0d7e
mov dword [ebp - 0x11c], 0
mov ecx, dword [ebp - 0x48]
xor ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x164], ecx
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x164], 0
je 0x6e0dab
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x8c], 0
jmp 0x6e0dc6
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov edx, dword [0x83b93c]
sub edx, 0x186d7
cmp dword [ebp - 0x8c], edx
jge 0x6e0e02
push 0xed
push 0x17415
push 0x1367a
push 0xca5d
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
add esp, 0x10
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
jmp 0x6e0db7
mov ecx, dword [ebp - 0x94]
sub ecx, 0x14
push ecx
mov edx, dword [0x83b9c4]
add edx, 0x20
push edx
call fcn.0041b030
add esp, 8
mov eax, dword [0x83b9f4]
sub eax, 0xd
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0xa
push ecx
mov edx, dword [0x83ba40]
sub edx, 0x32
push edx
mov eax, dword [0x83b9dc]
sub eax, 0x19
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x45
push ecx
mov edx, dword [0x83b93c]
add edx, 0xd
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x11
push eax
mov ecx, dword [0x83b9fc]
sub ecx, 0x15
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 3
push edx
call fcn.0041ed70
add esp, 0x24
mov eax, dword [ebp + 0x18]
or eax, 0x9073
xor eax, 0xb5b3
mov ecx, dword [ebp + 0xc]
or ecx, 0xd9dc
xor ecx, 0xfdf1
mov byte [ecx + str.NRmlPPTAaCEDVTWTtZYnP], al
mov dword [ebp - 0x90], 0
jmp 0x6e0eaf
mov edx, dword [ebp - 0x90]
add edx, 1
mov dword [ebp - 0x90], edx
mov eax, dword [0x83b9dc]
sub eax, 0x186d4
cmp dword [ebp - 0x90], eax
jge 0x6e0f68
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x168], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x168]
cmp ecx, dword [ebp - 0x16c]
jge 0x6e0efa
mov dword [ebp - 0x120], 1
jmp 0x6e0f04
mov dword [ebp - 0x120], 0
mov edx, dword [ebp - 0x94]
cmp edx, dword [ebp - 0x24]
jge 0x6e0f1b
mov dword [ebp - 0x124], 1
jmp 0x6e0f25
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x120]
or eax, dword [ebp - 0x124]
je 0x6e0f63
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
push 0xaa50
push 0xab29
push 0x15496
push 0x12acc
push 0x3b11
push 0xc49d
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add esp, 0x18
jmp 0x6e0ea0
mov dword [ebp - 0x98], 0
jmp 0x6e0f83
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
mov eax, dword [0x83b9d8]
sub eax, 0x186d3
cmp dword [ebp - 0x98], eax
jge 0x6e0fbe
push 0x592f
push 0x1675b
push 0xd346
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
mov ecx, dword [0x83b9f8]
add ecx, 1
mov dword [0x83b9f8], ecx
jmp 0x6e0f74
mov dword [ebp - 0x9c], 0
jmp 0x6e0fd9
mov edx, dword [ebp - 0x9c]
add edx, 1
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x4d
cmp dword [ebp - 0x9c], eax
jge 0x6e0ff2
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x6e0fca
mov eax, str.NRmlPPTAaCEDVTWTtZYnP
jmp 0x6e100b
mov esp, ebp
pop ebp
ret