Function at 0x418a40
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create thread
Delete registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Resume thread
Set registry value
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca3d6
mov eax, dword fs:[0]
push eax
mov eax, 0x1638
call fcn.0054c4b0
mov eax, dword [0x63fbf0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov ecx, dword [0x64de34]
mov dword [ebp - 0x15a0], edi
mov dword [ebp - 0x15d8], eax
call fcn.0043efa0
mov ecx, dword [0x64de40]
mov esi, eax
call fcn.0043efa0
xor ebx, ebx
cmp esi, ebx
je 0x41b9c0
cmp eax, ebx
je 0x41b9c0
cmp esi, eax
je 0x418adc
mov esi, edi
call fcn.004266e0
lea esp, [ebp - 0x1654]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544a28
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x64de38]
call fcn.0043efa0
mov ecx, dword [0x64de44]
mov esi, eax
call fcn.0043efa0
cmp esi, ebx
je 0x418ab1
cmp eax, ebx
je 0x418ab1
cmp esi, 2
jb 0x418ab1
cmp eax, 2
jb 0x418ab1
cmp esi, eax
jne 0x418ab1
mov ecx, dword [0x64de3c]
call fcn.0043efa0
mov ecx, dword [0x64de48]
mov esi, eax
call fcn.0043efa0
cmp esi, ebx
je 0x418ab1
cmp eax, ebx
je 0x418ab1
cmp esi, eax
jne 0x418ab1
mov dword [ebp - 0x1e4], 0x720045
mov dword [ebp - 0x1e0], 0x6f0072
mov dword [ebp - 0x1dc], 0x72
mov dword [ebp - 0x3cc], 0x70004f
mov dword [ebp - 0x3c8], 0x720065
mov dword [ebp - 0x3c4], 0x740061
mov dword [ebp - 0x3c0], 0x6e0069
mov dword [ebp - 0x3bc], 0x200067
mov dword [ebp - 0x3b8], 0x790073
mov dword [ebp - 0x3b4], 0x740073
mov dword [ebp - 0x3b0], 0x6d0065
mov dword [ebp - 0x3ac], 0x610020
mov dword [ebp - 0x3a8], 0x6e0062
mov dword [ebp - 0x3a4], 0x72006f
mov dword [ebp - 0x3a0], 0x61006d
mov dword [ebp - 0x39c], 0x6c
call fcn.004181f0
test eax, eax
je 0x418c6f
push 0xffffffffffffffff
push 0x619914
push 0x619914
push 0x619914
push 0x3a
lea eax, [ebp - 0x1c]
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], bl
call fcn.00408b50
add esp, 0x1c
push 0x600
call fcn.00445142
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x418c5e
lea ecx, [ebp - 0x3cc]
push ecx
mov edx, esi
call fcn.004049f0
add esp, 4
lea edx, [ebp - 0x1e4]
push edx
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push 0x40bff0
push ebx
push ebx
call edi
jmp 0x418ab8
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov word [ebp - 0x2d4], ax
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x15dc]
push eax
xor ecx, ecx
push 0xf003f
mov word [ebp - 0x1c4], cx
push ebx
lea ecx, [ebp - 0x404]
xor edx, edx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x404], 0x410048
mov dword [ebp - 0x400], 0x440052
mov dword [ebp - 0x3fc], 0x410057
mov dword [ebp - 0x3f8], 0x450052
mov dword [ebp - 0x3f4], 0x44005c
mov dword [ebp - 0x3f0], 0x530045
mov dword [ebp - 0x3ec], 0x520043
mov dword [ebp - 0x3e8], 0x500049
mov dword [ebp - 0x3e4], 0x490054
mov dword [ebp - 0x3e0], 0x4e004f
mov dword [ebp - 0x3dc], 0x53005c
mov dword [ebp - 0x3d8], 0x730079
mov dword [ebp - 0x3d4], 0x650074
mov dword [ebp - 0x3d0], 0x6d
mov dword [ebp - 0x398], 0x410048
mov dword [ebp - 0x394], 0x440052
mov dword [ebp - 0x390], 0x410057
mov dword [ebp - 0x38c], 0x450052
mov dword [ebp - 0x388], 0x41005c
mov dword [ebp - 0x384], 0x500043
mov dword [ebp - 0x380], 0x5c0049
mov dword [ebp - 0x37c], 0x530044
mov dword [ebp - 0x378], 0x540044
mov dword [ebp - 0x374], 0x56005c
mov dword [ebp - 0x370], 0x4f0042
mov dword [ebp - method.CWnd.virtual_156], 0x5f0058
mov dword [ebp - 0x368], 0x5f
mov dword [ebp - 0x2f8], 0x410048
mov dword [ebp - 0x2f4], 0x440052
mov dword [ebp - 0x2f0], 0x410057
mov dword [ebp - 0x2ec], 0x450052
mov dword [ebp - 0x2e8], 0x41005c
mov dword [ebp - 0x2e4], 0x500043
mov dword [ebp - 0x2e0], 0x5c0049
mov dword [ebp - 0x2dc], 0x530044
mov dword [ebp - 0x2d8], 0x540044
mov dword [ebp - 0x280], 0x790053
mov dword [ebp - 0x27c], 0x740073
mov dword [ebp - 0x278], 0x6d0065
mov dword [ebp - 0x274], 0x690042
mov dword [ebp - 0x270], 0x73006f
mov dword [ebp - 0x26c], 0x650056
mov dword [ebp - 0x268], 0x730072
mov dword [ebp - 0x264], 0x6f0069
mov dword [ebp - 0x260], 0x6e
mov dword [ebp - 0x25c], 0x690056
mov dword [ebp - 0x258], 0x650064
mov dword [ebp - 0x254], 0x42006f
mov dword [ebp - 0x250], 0x6f0069
mov dword [ebp - 0x24c], 0x560073
mov dword [ebp - 0x248], 0x720065
mov dword [ebp - 0x244], 0x690073
mov dword [ebp - 0x240], 0x6e006f
mov word [ebp - 0x23c], dx
mov dword [ebp - 0x1cc], 0x420056
mov dword [ebp - 0x1c8], 0x58004f
mov dword [ebp - 0x298], 0x690056
mov dword [ebp - 0x294], 0x740072
mov dword [ebp - 0x290], 0x610075
mov dword [ebp - 0x28c], 0x42006c
mov dword [ebp - 0x288], 0x78006f
mov dword [ebp - 0x17c], 0x4f0058
mov dword [ebp - 0x178], 0x560042
mov word [ebp - 0x174], dx
call esi
test eax, eax
jne 0x419103
push 0x207
lea edx, [ebp - 0x60b]
push ebx
push edx
mov byte [ebp - 0x60c], bl
call fcn.0054b8b0
add esp, 0xc
lea eax, [ebp - 0x15a8]
push eax
lea ecx, [ebp - 0x60c]
push ecx
mov ecx, dword [ebp - 0x15dc]
lea edx, [ebp - 0x15d0]
push edx
push ebx
lea eax, [ebp - 0x280]
push eax
push ecx
mov dword [ebp - 0x15d0], 7
mov dword [ebp - 0x15a8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4190f4
lea edx, [ebp - 0x1cc]
push edx
lea eax, [ebp - 0x60c]
push eax
call fcn.00545f39
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 8
test eax, eax
je 0x418fe5
lea eax, [ebp - 0x17c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x418fb7
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
mov ecx, dword [ebp - 0x15dc]
lea edx, [ebp - 0x17c]
push edx
push 7
push ebx
lea eax, [ebp - 0x280]
push eax
push ecx
call edi
push 0x208
lea edx, [ebp - 0x60c]
push ebx
push edx
call fcn.0054b8b0
add esp, 0xc
lea eax, [ebp - 0x15a8]
push eax
lea ecx, [ebp - 0x60c]
push ecx
mov ecx, dword [ebp - 0x15dc]
lea edx, [ebp - 0x15d0]
push edx
push ebx
lea eax, [ebp - 0x25c]
push eax
push ecx
mov dword [ebp - 0x15a8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4190f4
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x60c]
push eax
call fcn.00545f39
add esp, 8
test eax, eax
je 0x41908e
lea eax, [ebp - 0x17c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x419060
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
mov ecx, dword [ebp - 0x15dc]
lea edx, [ebp - 0x17c]
push edx
push 7
push ebx
lea eax, [ebp - 0x25c]
push eax
push ecx
call edi
lea edx, [ebp - 0x15c4]
push edx
push 0xf003f
push ebx
lea eax, [ebp - 0x398]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4190f4
mov ecx, dword [ebp - 0x15c4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp - 0x15c4]
push edx
push 0xf003f
push ebx
lea eax, [ebp - 0x2f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4190fa
mov ecx, dword [ebp - 0x15c4]
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edx, dword [ebp - 0x15c4]
push edx
call edi
jmp 0x4190fa
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x15dc]
push eax
call edi
lea ecx, [ebp - 0xe8]
xor eax, eax
push ecx
mov dword [ebp - 0x1b4], 0x720045
mov dword [ebp - 0x1b0], 0x6f0072
mov dword [ebp - 0x1ac], 0x72
mov dword [ebp - 0x364], 0x6f0059
mov dword [ebp - 0x360], 0x720075
mov dword [ebp - 0x35c], 0x630020
mov dword [ebp - 0x358], 0x6d006f
mov dword [ebp - 0x354], 0x750070
mov dword [ebp - 0x350], 0x650074
mov dword [ebp - 0x34c], 0x200072
mov dword [ebp - 0x348], 0x61006d
mov dword [ebp - 0x344], 0x200079
mov dword [ebp - 0x340], 0x650062
mov dword [ebp - 0x33c], 0x690020
mov dword [ebp - 0x338], 0x66006e
mov dword [ebp - 0x334], 0x630065
mov dword [ebp - 0x330], 0x650074
mov dword [ebp - 0x32c], 0x200064
mov dword [ebp - 0x328], 0x790062
mov dword [ebp - 0x324], 0x610020
mov dword [ebp - 0x320], 0x630020
mov dword [ebp - 0x31c], 0x6d006f
mov dword [ebp - 0x318], 0x750070
mov dword [ebp - 0x314], 0x650074
mov dword [ebp - 0x310], 0x200072
mov dword [ebp - 0x30c], 0x690076
mov dword [ebp - 0x308], 0x750072
mov dword [ebp - 0x304], 0x2e0073
mov word [ebp - 0x300], ax
mov dword [ebp - 0xe8], 0x534e4957
mov dword [ebp - 0xe4], 0x4c4f4f50
mov dword [ebp - 0xe0], 0x5652442e
mov byte [ebp - 0xdc], bl
mov dword [ebp - 0x140], 0x69775c3a
mov dword [ebp - 0x13c], 0x776f646e
mov dword [ebp - 0x138], 0x79735c73
mov dword [ebp - 0x134], 0x776f7773
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x12c], 0x69775c3a
mov dword [ebp - 0x128], 0x776f646e
mov dword [ebp - 0x124], 0x79735c73
mov dword [ebp - 0x120], 0x6d657473
mov byte [ebp - 0x11c], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp esi, ebx
je 0x4193dd
push 0x1ff
lea edx, [ebp - 0x603]
push ebx
push edx
mov byte [ebp - 0x604], bl
call fcn.0054b8b0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x604]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x419358
push 0xffffffffffffffff
push 0x619914
push 0x619914
push 0x619914
push 0x3b
lea ecx, [ebp - 0x1c]
push 0x4d
push ecx
mov byte [ebp - 0x16], bl
mov word [ebp - 0x18], 0x6473
mov dword [ebp - 0x1c], 0x73736463
call fcn.00408b50
add esp, 0x1c
push 0x600
call fcn.00445142
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x418c5e
lea edx, [ebp - 0x364]
push edx
mov edx, esi
call fcn.004049f0
add esp, 4
lea eax, [ebp - 0x1b4]
push eax
jmp 0x418c3d
lea eax, [ebp - 0x604]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419361
sub eax, edx
mov edi, eax
xor esi, esi
cmp edi, ebx
jbe 0x41938f
movsx ecx, byte [ebp + esi - 0x604]
push ecx
call fcn.005481d2
mov byte [ebp + esi - 0x604], al
inc esi
add esp, 4
cmp esi, edi
jb 0x419372
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x604]
push eax
call fcn.00545340
add esp, 8
test eax, eax
jne 0x4193dd
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x604]
push edx
call fcn.00545340
add esp, 8
test eax, eax
jne 0x4193dd
push 0xffffffffffffffff
lea eax, [ebp - 0x604]
push eax
push 0x619914
push 0x619914
push 0x3c
jmp 0x419300
mov eax, dword [ebp - 0x15a0]
lea ecx, [eax + 0x180]
push ecx
push eax
call fcn.0043f1d0
add esp, 8
call fcn.00412730
mov ecx, dword [0x64d974]
call fcn.0043efa0
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xbc]
xor edx, edx
push ecx
mov dword [ebp - 0x15ec], edi
mov dword [ebp - 0x218], 0x610043
mov dword [ebp - 0x214], 0x27006e
mov dword [ebp - 0x210], 0x200074
mov dword [ebp - 0x20c], 0x740053
mov dword [ebp - 0x208], 0x720061
mov dword [ebp - 0x204], 0x200074
mov dword [ebp - 0x200], 0x610047
mov dword [ebp - 0x1fc], 0x65006d
mov dword [ebp - 0x1f8], 0x430020
mov dword [ebp - 0x1f4], 0x69006c
mov dword [ebp - 0x1f0], 0x6e0065
mov dword [ebp - 0x1ec], 0x2e0074
mov word [ebp - 0x1e8], dx
mov dword [ebp - 0x188], 0x720045
mov dword [ebp - 0x184], 0x6f0072
mov dword [ebp - 0x180], 0x72
mov dword [ebp - 0xbc], 0x6e72656b
mov dword [ebp - 0xb8], 0x32336c65
mov dword [ebp - 0xb4], 0x6c6c642e
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0xf8], 0x54746547
mov dword [ebp - 0xf4], 0x436b6369
mov dword [ebp - 0xf0], 0x746e756f
mov byte [ebp - 0xec], bl
mov dword [ebp - 0x170], 0x72657551
mov dword [ebp - 0x16c], 0x72655079
mov dword [ebp - 0x168], 0x6d726f66
mov dword [ebp - 0x164], 0x65636e61
mov dword [ebp - 0x160], 0x6e756f43
mov dword [ebp - 0x15c], 0x726574
mov dword [ebp - 0x118], 0x61657243
mov dword [ebp - 0x114], 0x72506574
mov dword [ebp - 0x110], 0x7365636f
mov word [ebp - 0x10c], 0x4173
mov byte [ebp - 0x10a], bl
mov dword [ebp - 0x108], 0x61657243
mov dword [ebp - 0x104], 0x72506574
mov dword [ebp - 0x100], 0x7365636f
mov word [ebp - 0xfc], 0x5773
mov byte [ebp - 0xfa], bl
call fcn.00560f90
mov esi, eax
cmp esi, ebx
je 0x4196c3
cmp byte [esi], 0xe9
jne 0x4196c3
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x419605
lea edx, [ebp - 0x218]
push edx
mov edx, edi
call fcn.004049f0
lea eax, [ebp - 0x188]
add esp, 4
push eax
lea edx, [edi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push edi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [ebp - 0x603]
push ebx
push ecx
mov dword [ebp - 0x15c8], ebx
mov byte [ebp - 0x604], bl
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xb62]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xb64], dx
call fcn.0054b8b0
mov edx, dword [esi + 1]
add esp, 0xc
lea ecx, [ebp - 0x15c8]
lea eax, [edx + esi + 5]
push ecx
push eax
lea esi, [ebp - 0xb64]
lea edi, [ebp - 0x604]
call fcn.00401310
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419670
sub eax, edx
je 0x4196ae
push 0xffffffffffffffff
lea ecx, [ebp - 0x604]
push ecx
push 0x619914
push 0x619914
push 0x3d
lea edx, [ebp - 0x1c]
push 0x4d
push edx
mov byte [ebp - 0x16], bl
mov word [ebp - 0x18], 0x6473
mov dword [ebp - 0x1c], 0x73736463
call fcn.00408b50
add esp, 0x1c
push ebx
push ebx
push ebx
push 0x40bff0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x418ab8
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0xbc]
push ecx
call fcn.00560f90
mov esi, eax
cmp esi, ebx
je 0x4197bd
cmp byte [esi], 0xe9
jne 0x4197bd
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x419740
lea edx, [ebp - 0x218]
push edx
mov edx, edi
call fcn.004049f0
lea eax, [ebp - 0x188]
add esp, 4
push eax
lea edx, [edi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push edi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [ebp - 0x603]
push ebx
push ecx
mov dword [ebp - 0x15c8], ebx
mov byte [ebp - 0x604], bl
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xb62]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xb64], dx
call fcn.0054b8b0
mov edx, dword [esi + 1]
add esp, 0xc
lea ecx, [ebp - 0x15c8]
lea eax, [edx + esi + 5]
push ecx
push eax
lea esi, [ebp - 0xb64]
lea edi, [ebp - 0x604]
call fcn.00401310
mov eax, edi
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4197a7
sub eax, edx
je 0x4196ae
push 0xfffffffffffffffe
jmp 0x41967d
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xbc]
push ecx
call fcn.00560f90
mov esi, eax
cmp esi, ebx
je 0x4198b7
cmp byte [esi], 0xe9
jne 0x4198b7
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x41983a
lea edx, [ebp - 0x218]
push edx
mov edx, edi
call fcn.004049f0
lea eax, [ebp - 0x188]
add esp, 4
push eax
lea edx, [edi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push edi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [ebp - 0x603]
push ebx
push ecx
mov dword [ebp - 0x15c8], ebx
mov byte [ebp - 0x604], bl
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xb62]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xb64], dx
call fcn.0054b8b0
mov edx, dword [esi + 1]
add esp, 0xc
lea ecx, [ebp - 0x15c8]
lea eax, [edx + esi + 5]
push ecx
push eax
lea esi, [ebp - 0xb64]
lea edi, [ebp - 0x604]
call fcn.00401310
mov eax, edi
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4198a1
sub eax, edx
je 0x4196ae
push 0xfffffffffffffffd
jmp 0x41967d
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xbc]
push ecx
call fcn.00560f90
mov esi, eax
cmp esi, ebx
je 0x4199b6
cmp byte [esi], 0xe9
jne 0x4199b6
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x419934
lea edx, [ebp - 0x218]
push edx
mov edx, edi
call fcn.004049f0
lea eax, [ebp - 0x188]
add esp, 4
push eax
lea edx, [edi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push edi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1ff
lea ecx, [ebp - 0x603]
push ebx
push ecx
mov dword [ebp - 0x15c8], ebx
mov byte [ebp - 0x604], bl
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xb62]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xb64], dx
call fcn.0054b8b0
mov edx, dword [esi + 1]
add esp, 0xc
lea ecx, [ebp - 0x15c8]
lea eax, [edx + esi + 5]
push ecx
push eax
lea esi, [ebp - 0xb64]
lea edi, [ebp - 0x604]
call fcn.00401310
mov eax, edi
add esp, 8
lea edx, [eax + 1]
jmp 0x4199a0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4199a0
sub eax, edx
je 0x4196ae
push 0xfffffffffffffffc
jmp 0x41967d
xor ecx, ecx
push 0x206
mov word [ebp - 0x194], cx
mov word [ebp - 0x18c], cx
lea ecx, [ebp - 0x106a]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x19c], 0x730025
mov dword [ebp - 0x198], 0x730025
mov dword [ebp - 0x190], 0x620072
mov dword [ebp - 0x238], 0x690046
mov dword [ebp - 0x234], 0x65006c
mov dword [ebp - 0x230], 0x630020
mov dword [ebp - 0x22c], 0x72006f
mov dword [ebp - 0x228], 0x750072
mov dword [ebp - 0x224], 0x740070
mov dword [ebp - 0x220], 0x640065
mov dword [ebp - 0x21c], 0x21
mov dword [ebp - 0x1a8], 0x6f004c
mov dword [ebp - 0x1a4], 0x690067
mov dword [ebp - 0x1a0], 0x6e
mov dword [ebp - 0x15d4], ebx
mov word [ebp - 0x106c], ax
call fcn.0054b8b0
add esp, 0xc
lea eax, [edi + 0x4da]
push eax
lea edx, [ebp - 0x19c]
push 0x64d560
push edx
lea edx, [ebp - 0x106c]
mov dword [ebp - 0x15c4], eax
call fcn.004098c0
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x106c]
push ecx
lea edx, [ebp - 0x15d4]
push edx
call fcn.00545992
mov eax, dword [ebp - 0x15d4]
add esp, 0xc
cmp eax, ebx
jne 0x419b63
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x419b21
lea eax, [ebp - 0x238]
push eax
mov edx, esi
call fcn.004049f0
lea ecx, [ebp - 0x1a8]
add esp, 4
push ecx
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffb
push 0x619914
push 0x619914
push 0x619914
push 0x3d
lea edx, [ebp - 0x1c]
push 0x4d
push edx
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], bl
call fcn.00408b50
add esp, 0x1c
push ebx
push ebx
push ebx
push 0x40bff0
push ebx
push ebx
call edi
jmp 0x418ab8
push 2
push ebx
push eax
call fcn.0054764f
mov eax, dword [ebp - 0x15d4]
add esp, 0xc
push eax
call fcn.0054785f
mov ecx, dword [ebp - 0x15d4]
add esp, 4
push ebx
push ebx
push ecx
mov esi, eax
call fcn.0054764f
add esp, 0xc
push esi
call fcn.0044517c
mov edx, dword [ebp - 0x15d4]
add esp, 4
push edx
push 1
mov edi, eax
push esi
push edi
call fcn.00547b0e
mov eax, dword [ebp - 0x15d4]
push eax
call fcn.00545dfd
lea ecx, [ebp - 0x14dc]
add esp, 0x14
push ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.0056c160
add esp, 4
push esi
lea edx, [ebp - 0x14dc]
push edi
push edx
call fcn.0056bf30
add esp, 0xc
lea eax, [ebp - 0x14dc]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0056c010
push edi
call fcn.00445171
lea edx, [ebp - 0x153c]
add esp, 0xc
push edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0056bef0
add esp, 4
push 0x14
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x153c]
push ecx
call fcn.0056bce0
add esp, 0xc
lea edx, [ebp - 0x153c]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.0056bdc0
mov ecx, dword [ebp - 0x15d8]
add esp, 8
call fcn.0043efa0
add eax, 0xc
lea ecx, [ebp - 0x2c]
mov edx, 0x10
sub ecx, eax
mov edi, edi
mov esi, dword [ecx + eax]
cmp esi, dword [eax]
jne 0x419d46
sub edx, 4
add eax, 4
cmp edx, 4
jae 0x419c60
mov ecx, dword [0x64de2c]
call fcn.0043efa0
test eax, eax
je 0x419d40
mov ecx, dword [0x64de30]
call fcn.0043efa0
test eax, eax
je 0x419d40
push 0x208
lea ecx, [ebp - 0x106c]
push ebx
push ecx
call fcn.0054b8b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x106c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x30
lea eax, [ebp - 0x156c]
push ebx
push eax
call fcn.0054b8b0
add esp, 0xc
lea ecx, [ebp - 0x156c]
push ecx
lea edx, [ebp - 0x106c]
push edx
call fcn.005482fb
add esp, 8
test eax, eax
jne 0x419de1
cmp dword [ebp - 0x1558], 0x864700
jl 0x419de1
push 0xfffffffffffffff9
push 0x619914
push 0x619914
push 0x619914
push 0x3d
lea eax, [ebp - 0x1c]
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], bl
call fcn.00408b50
mov esi, dword [ebp - 0x15a0]
add esp, 0x1c
call fcn.004266e0
push ebx
call fcn.00547091
push ebx
push ebx
call fcn.0043f1d0
push 0x600
call fcn.00445142
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x419d9f
lea ecx, [ebp - 0x238]
push ecx
mov edx, esi
call fcn.004049f0
lea edx, [ebp - 0x1a8]
add esp, 4
push edx
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffa
push 0x619914
push 0x619914
push 0x619914
push 0x3d
lea eax, [ebp - 0x1c]
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], bl
call fcn.00408b50
add esp, 0x1c
push ebx
push ebx
push ebx
push 0x40bff0
push ebx
push ebx
call edi
jmp 0x418ab8
push 0xc
lea ecx, [ebp - 0x15fc]
push ecx
push ebx
mov dword [ebp - 0x15fc], ebx
mov dword [ebp - 0x15f8], ebx
mov dword [ebp - 0x15f4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov eax, dword [ebp - 0x15fc]
mov edi, dword [ebp - 0x15f8]
mov ecx, dword [0x64ddfc]
add edi, eax
cmp byte [ecx], 0xe9
je 0x419e47
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x15a0]
call fcn.004266e0
push ebx
call fcn.00547091
mov edx, dword [ecx + 1]
lea ecx, [edx + ecx + 5]
cmp ecx, eax
jb 0x419e2c
cmp ecx, edi
ja 0x419e2c
mov ecx, dword [0x64de18]
cmp byte [ecx], 0xe9
jne 0x419e2c
mov edx, dword [ecx + 1]
lea ecx, [edx + ecx + 5]
cmp ecx, eax
jb 0x419e2c
cmp ecx, edi
ja 0x419e2c
mov ecx, dword [0x64de20]
cmp byte [ecx], 0xe9
jne 0x419e2c
mov edx, dword [ecx + 1]
lea ecx, [edx + ecx + 5]
cmp ecx, eax
jb 0x419e2c
cmp ecx, edi
ja 0x419e2c
mov ecx, dword [0x64de28]
cmp byte [ecx], 0xe9
jne 0x419e2c
mov edx, dword [ecx + 1]
lea ecx, [edx + ecx + 5]
cmp ecx, eax
jb 0x419e2c
cmp ecx, edi
ja 0x419e2c
push 0x44
lea eax, [ebp - 0x1644]
push ebx
push eax
mov dword [ebp - 0x15bc], ebx
mov dword [ebp - 0x15b8], ebx
mov dword [ebp - 0x15b4], ebx
mov dword [ebp - 0x15b0], ebx
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea edx, [ebp - 0x147a]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x1644], 0x44
mov word [ebp - 0x147c], cx
call fcn.0054b8b0
add esp, 0xc
push 0x206
lea ecx, [ebp - 0x95a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x95c], ax
call fcn.0054b8b0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x753]
push ebx
push edx
mov byte [ebp - 0x754], bl
call fcn.0054b8b0
add esp, 0xc
mov byte [ebp - 0x15bd], bl
mov dword [ebp - 0x4d4], 0xbeabb1be
mov dword [ebp - 0x4d0], 0xcad6bbaa
mov dword [ebp - 0x4cc], 0xcad5b2e1
mov dword [ebp - 0x4c8], 0xc2bc002e
mov dword [ebp - 0x4c4], 0xcec4b5c4
mov dword [ebp - 0x4c0], 0x71d5c2
mov dword [ebp - 0x4bc], 0x650077
mov dword [ebp - 0x4b8], 0x740072
mov dword [ebp - 0x4b4], 0xd2d40079
mov dword [ebp - 0x4b0], 0xd1a9bfb4
mov dword [ebp - 0x4ac], 0xc2db002e
mov dword [ebp - 0x4a8], 0xd4adccb3
mov dword [ebp - 0x4a4], 0x570051
mov dword [ebp - 0x4a0], 0x520045
mov dword [ebp - 0x49c], 0x590054
mov dword [ebp - 0x498], 0x690075
mov dword [ebp - 0x494], 0x70006f
mov dword [ebp - 0x490], 0xcec4b4b4
mov dword [ebp - 0x48c], 0xceaad5c2
mov dword [ebp - 0x488], 0xd7aad6f7
mov dword [ebp - 0x484], 0x62ccfb
mov dword [ebp - 0x480], 0x6d006e
mov dword [ebp - 0x47c], 0x48004b
mov dword [ebp - 0x478], 0x440046
mov dword [ebp - 0x474], 0xc2db0053
mov dword [ebp - 0x470], 0xbbf2ccb3
mov dword [ebp - 0x46c], 0xb9d8cfe0
mov dword [ebp - 0x468], 0xc2dbb5c4
mov dword [ebp - 0x464], 0xd7a2ccb3
mov dword [ebp - 0x460], 0xd3c3b2e1
mov dword [ebp - 0x45c], 0xcbf9bba7
mov dword [ebp - 0x458], 0xb5c4d3d0
mov dword [ebp - 0x454], 0xd7f7b9a4
mov dword [ebp - 0x450], 0xcbf9bcb0
mov dword [ebp - 0x44c], 0xcdf8d3d0
mov dword [ebp - 0x448], 0xb6d4d3d1
mov dword [ebp - 0x444], 0x310042
mov dword [ebp - 0x440], 0x330032
mov dword [ebp - 0x43c], 0x350034
mov dword [ebp - 0x438], 0x370036
mov dword [ebp - 0x434], 0x390038
mov dword [ebp - 0x430], 0xd6cad0d4
mov dword [ebp - 0x42c], 0xcec4b5c4
mov dword [ebp - 0x428], 0xb3fdd5c2
mov dword [ebp - 0x424], 0xccd8b7c7
mov dword [ebp - 0x420], 0xb1f0002e
push 0x3e
lea eax, [ebp - 0x64a]
xor ecx, ecx
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x41c], 0xd0e3d3c5
mov dword [ebp - 0x418], 0xd2bbb5c4
mov dword [ebp - 0x414], 0xb2bbb0e3
mov dword [ebp - 0x410], 0xc2bccad5
mov word [ebp - 0x40c], cx
mov word [ebp - 0x64c], dx
call fcn.0054b8b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00548759
add esp, 4
call fcn.0054876b
cdq
mov ecx, 0xa
idiv ecx
xor edi, edi
lea esi, [edx + 3]
cmp esi, ebx
jle 0x41a1b7
lea eax, [ebp - 0x4d4]
lea edx, [eax + 2]
jmp 0x41a180
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a180
sub eax, edx
sar eax, 1
mov dword [ebp - 0x15cc], eax
call fcn.0054876b
xor edx, edx
div dword [ebp - 0x15cc]
inc edi
mov dx, word [ebp + edx*2 - 0x4d4]
mov word [ebp + edi*2 - 0x64e], dx
cmp edi, esi
jl 0x41a195
xor edi, edi
lea esp, [esp]
mov ecx, dword [ebp - 0x15c4]
lea eax, [ebp - 0x64c]
push eax
push ecx
call fcn.0054878c
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x41a23c
inc edi
cmp edi, 0x64
jl 0x41a1c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x41a215
cmp edi, ebx
je 0x41a23c
push ebx
push ebx
call fcn.0043f1d0
push esi
mov esi, edi
mov edi, 0x61c150
call fcn.00430d50
add esp, 0xc
mov esi, dword [ebp - 0x15a0]
jmp 0x418ab3
cmp edi, ebx
je 0x41a23c
push ebx
push ebx
call fcn.0043f1d0
mov esi, edi
push 0xffffffffffffffff
mov edi, 0x61c180
call fcn.00430d50
mov esi, dword [ebp - 0x15a0]
add esp, 0xc
jmp 0x418ab3
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x19c]
push 0x64d560
push eax
lea edx, [ebp - 0x147c]
call fcn.004098c0
mov eax, dword [ebp - 0x15ec]
add esp, 0xc
add eax, 0x51b
push eax
lea ecx, [ebp - 0x19c]
push 0x64d560
push ecx
lea edx, [ebp - 0x95c]
mov dword [ebp - 0x15c8], eax
call fcn.004098c0
lea edx, [ebp - 0x754]
add esp, 0xc
push edx
lea esi, [ebp - 0x95c]
call fcn.0043f980
mov ecx, dword [0x64de34]
add esp, 4
call fcn.0043efa0
mov ecx, dword [0x64de40]
mov esi, eax
call fcn.0043efa0
cmp esi, ebx
je 0x41a20a
cmp eax, ebx
je 0x41a20a
cmp esi, eax
jne 0x41a20a
mov ecx, dword [0x64de38]
call fcn.0043efa0
mov ecx, dword [0x64de44]
mov esi, eax
call fcn.0043efa0
cmp esi, ebx
je 0x41a20a
cmp eax, ebx
je 0x41a20a
cmp esi, 2
jb 0x41a20a
cmp eax, 2
jb 0x41a20a
cmp esi, eax
jne 0x41a20a
mov ecx, dword [0x64de3c]
call fcn.0043efa0
mov ecx, dword [0x64de48]
mov esi, eax
call fcn.0043efa0
cmp esi, eax
jne 0x41a20a
push 0x30
lea eax, [ebp - 0x159c]
push ebx
push eax
mov dword [ebp - 0x15a8], ebx
mov dword [ebp - 0x15cc], ebx
mov dword [ebp - 0x15d0], ebx
call fcn.0054b8b0
add esp, 0xc
lea ecx, [ebp - 0x190]
push ecx
lea edx, [ebp - 0x95c]
push edx
lea eax, [ebp - 0x15e8]
push eax
call fcn.00545992
add esp, 0xc
test eax, eax
jne 0x41a523
lea ecx, [ebp - 0x159c]
push ecx
lea edx, [ebp - 0x95c]
push edx
call fcn.005482fb
add esp, 8
test eax, eax
je 0x41a3c3
mov eax, dword [ebp - 0x15e8]
push eax
call fcn.00545dfd
mov ecx, dword [ebp - 0x15c4]
add esp, 4
push ecx
lea edx, [ebp - 0x64c]
push edx
call fcn.0054878c
mov esi, dword [ebp - 0x15a0]
add esp, 8
jmp 0x418ab3
mov edi, dword [ebp - 0x1588]
push edi
call fcn.0044517c
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x15e8]
push eax
push 1
push edi
push esi
call fcn.00547b0e
mov ecx, dword [ebp - 0x15e8]
push ecx
call fcn.00545dfd
lea edx, [ebp - 0x14dc]
add esp, 0x14
push edx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.0056c160
add esp, 4
push edi
lea eax, [ebp - 0x14dc]
push esi
push eax
call fcn.0056bf30
add esp, 0xc
lea ecx, [ebp - 0x14dc]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0056c010
push esi
call fcn.00445171
lea eax, [ebp - 0x153c]
add esp, 0xc
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0056bef0
add esp, 4
push 0x14
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x153c]
push edx
call fcn.0056bce0
add esp, 0xc
lea eax, [ebp - 0x153c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0056bdc0
mov ecx, dword [ebp - 0x15d8]
add esp, 8
call fcn.0043efa0
mov esi, eax
lea eax, [esi + 0x1c]
lea ecx, [ebp - 0x2c]
mov edx, 0x10
sub ecx, eax
mov edi, dword [ecx + eax]
cmp edi, dword [eax]
jne 0x41a4f4
sub edx, 4
add eax, 4
cmp edx, 4
jae 0x41a498
mov esi, dword [ebp - 0x15a0]
push 0x409
mov ecx, esi
call fcn.00454da4
mov ecx, eax
call fcn.00454fac
test eax, eax
je 0x41a544
mov eax, dword [esi + 0x1b0]
mov dword [ebp - 0x15e0], eax
cmp dword [esi + 0x1b4], ebx
je 0x41a54e
cmp eax, ebx
je 0x41a54e
call fcn.00418710
cmp eax, 0x10
je 0x41a54e
call fcn.00418750
jmp 0x41a54e
xor edx, edx
mov dword [ebp - 0x95c], edx
mov ecx, dword [esi + 0xb4]
push ecx
call fcn.00445171
mov edx, dword [esi + 0xb8]
add esp, 4
push edx
call fcn.00445171
add esp, 4
push esi
call fcn.00445171
add esp, 4
mov eax, dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0054878c
mov esi, dword [ebp - 0x15a0]
add esp, 8
jmp 0x418ab3
mov dword [ebp - 0x15e0], 0xffffffff
push 0x206
lea eax, [ebp - 0x1272]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1274], dx
call fcn.0054b8b0
add esp, 0xc
xor edx, edx
push 0x64d7e8
lea ecx, [ebp - 0x1d8]
mov word [ebp - 0x1d0], dx
xor eax, eax
push 0x61bff4
push ecx
lea edx, [ebp - 0x1274]
mov dword [ebp - 0x1d8], 0x730025
mov dword [ebp - 0x1d4], 0x730025
mov dword [ebp - 0x1c0], 0x74004f
mov dword [ebp - 0x1bc], 0x650068
mov dword [ebp - 0x1b8], 0x72
mov dword [ebp - 0x2d0], 0x6f0043
mov dword [ebp - 0x2cc], 0x70006d
mov dword [ebp - 0x2c8], 0x740061
mov dword [ebp - 0x2c4], 0x6e0045
mov dword [ebp - 0x2c0], 0x620061
mov dword [ebp - 0x2bc], 0x65006c
mov word [ebp - 0x2b8], ax
call fcn.004098c0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
lea edx, [ebp - 0x1274]
push edx
push 1
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
call esi
cmp eax, 1
jl 0x41a634
call fcn.00418a00
lea eax, [ebp - 0x1274]
push eax
xor edx, edx
push 2
lea ecx, [ebp - 0x2b4]
mov word [ebp - 0x29c], dx
push ecx
lea edx, [ebp - 0x1c0]
push edx
mov dword [ebp - 0x2b4], 0x70004f
mov dword [ebp - 0x2b0], 0x690074
mov dword [ebp - 0x2ac], 0x69006d
mov dword [ebp - 0x2a8], 0x61007a
mov dword [ebp - 0x2a4], 0x690074
mov dword [ebp - 0x2a0], 0x6e006f
call esi
cmp eax, 2
jl 0x41a717
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x30], 0x640064
mov dword [ebp - 0x2c], 0x610072
mov dword [ebp - 0x28], 0x2e0077
mov dword [ebp - 0x24], 0x6c0064
mov dword [ebp - 0x20], 0x6c
mov dword [ebp - 0xac], 0x640064
mov dword [ebp - 0xa8], 0x610072
mov dword [ebp - 0xa4], 0x2e0077
mov dword [ebp - 0xa0], 0x6c0064
mov dword [ebp - 0x9c], 0x2e006c
mov dword [ebp - 0x98], 0x610062
mov dword [ebp - 0x94], 0x6b
call fcn.0054878c
add esp, 8
call fcn.004184e0
cmp eax, 1
jne 0x41a736
mov esi, dword [ebp - 0x15c8]
lea edx, [ebp - 0x754]
push edx
call fcn.0043f980
add esp, 4
mov esi, ebx
mov edi, ebx
lea ebx, [ebx]
cmp edi, 0x32
jg 0x41a798
cmp esi, 0x64
jg 0x41a798
push ebx
lea eax, [ebp - 0x754]
push eax
lea ecx, [ebp - 0x15bc]
push ecx
lea edx, [ebp - 0x1644]
push edx
push ebx
push ebx
push 0x404
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x147c]
push eax
call fcn.005648f0
mov dword [ebp - 0x15a8], eax
cmp eax, ebx
jne 0x41a798
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x15cc], eax
cmp eax, 2
jne 0x41a795
inc edi
jmp 0x41a740
inc esi
jmp 0x41a740
mov eax, dword [0x64f018]
sub eax, dword [0x64f014]
mov byte [ebp - 0x15a1], bl
sar eax, 2
mov dword [ebp - 0x1c], eax
cmp eax, ebx
ja 0x41a7ba
mov byte [ebp - 0x15a1], 1
mov dword [ebp - 0x15ac], ebx
cmp eax, ebx
jbe 0x41a9c2
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, 0x103
mov edx, dword [ebp - 0x15ac]
mov eax, dword [0x64f014]
lea ecx, [ebp - 0x15f0]
push ecx
mov ecx, dword [eax + edx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x41a920
cmp dword [ebp - 0x15f0], edi
jne 0x41a8c2
mov edx, dword [0x64f014]
mov eax, dword [ebp - 0x15ac]
mov ecx, dword [edx + eax*4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, ebx
jbe 0x41a8ab
push 0xffffffffffffffff
push 0x619914
push 0x619914
lea edx, [ebp - 0x68]
push edx
push 0x35
lea eax, [ebp - 0x4c]
push 0x4d
push eax
mov byte [ebp - 0x15a1], 1
mov dword [ebp - 0x4c], 0x73736463
mov word [ebp - 0x48], 0x6473
mov byte [ebp - 0x46], bl
mov dword [ebp - 0x68], 0x63656843
mov dword [ebp - 0x64], 0x6854206b
mov dword [ebp - 0x60], 0x64616572
mov dword [ebp - 0x5c], 0x73755320
mov dword [ebp - 0x58], 0x646e6570
mov byte [ebp - 0x54], bl
call fcn.00408b50
add esp, 0x1c
call fcn.00412730
jmp 0x41a890
mov ecx, dword [0x64f014]
mov edx, dword [ebp - 0x15ac]
mov eax, dword [ecx + edx*4]
push eax
call esi
cmp eax, ebx
jne 0x41a890
jmp 0x41a9ac
mov ecx, dword [0x64f014]
mov edx, dword [ebp - 0x15ac]
mov eax, dword [ecx + edx*4]
push eax
call esi
jmp 0x41a9ac
push 0xffffffffffffffff
push 0x619914
push 0x619914
lea ecx, [ebp - 0x6c]
push ecx
push 0x36
push 0x4d
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x73736463
mov word [ebp - 0x34], 0x6473
mov byte [ebp - 0x32], bl
mov dword [ebp - 0x6c], 0x63656843
mov dword [ebp - 0x68], 0x6854206b
mov dword [ebp - 0x64], 0x64616572
mov dword [ebp - 0x60], 0x6f745320
mov dword [ebp - 0x5c], 0x726f2070
mov dword [ebp - 0x58], 0x6e614320
mov dword [ebp - 0x54], 0x6c6563
push edx
jmp 0x41a998
push 0xffffffffffffffff
push 0x619914
push 0x619914
lea eax, [ebp - 0x90]
push eax
push 0x37
push 0x4d
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x73736463
mov word [ebp - 0x20], 0x6473
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x90], 0x63656843
mov dword [ebp - 0x8c], 0x6854206b
mov dword [ebp - 0x88], 0x64616572
mov dword [ebp - 0x84], 0x73694d20
mov dword [ebp - 0x80], 0x676e6973
mov dword [ebp - 0x7c], 0x20726f20
mov dword [ebp - 0x78], 0x20746f4e
mov dword [ebp - 0x74], 0x61657243
mov word [ebp - 0x70], 0x6574
mov byte [ebp - 0x6e], bl
push ecx
mov byte [ebp - 0x15a1], 1
call fcn.00408b50
add esp, 0x1c
call fcn.00412730
mov eax, dword [ebp - 0x15ac]
inc eax
mov dword [ebp - 0x15ac], eax
cmp eax, dword [ebp - 0x1c]
jb 0x41a7d3
push 0x103
lea edx, [ebp - 0xe63]
push ebx
push edx
mov dword [ebp - 0xd8], 0x6e72656b
mov dword [ebp - 0xd4], 0x32336c65
mov dword [ebp - 0xd0], 0x6c6c642e
mov byte [ebp - 0xcc], bl
mov byte [ebp - 0xe64], bl
call fcn.0054b8b0
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov dword [ebp - 0x158], 0x57746547
mov dword [ebp - 0x154], 0x6f646e69
mov dword [ebp - 0x150], 0x69447377
mov dword [ebp - 0x14c], 0x74636572
mov dword [ebp - 0x148], 0x4179726f
mov byte [ebp - 0x144], bl
mov dword [ebp - 0xc8], 0x6278795c
mov dword [ebp - 0xc4], 0x692e7173
mov word [ebp - 0xc0], 0x696e
mov byte [ebp - 0xbe], bl
call fcn.00560f90
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x41ad07
push 0x104
lea edx, [ebp - 0xe64]
push edx
call eax
cmp eax, ebx
jbe 0x41ad07
push 0x103
lea eax, [ebp - 0x50b]
push ebx
push eax
mov byte [ebp - 0x50c], bl
call fcn.0054b8b0
add esp, 0xc
lea ecx, [ebp - 0xe64]
push ecx
lea edx, [ebp - 0x50c]
push 0x104
push edx
call fcn.00547e61
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x50c]
push 0x104
push ecx
call fcn.00549bcf
add esp, 0xc
lea eax, [ebp - 0x50c]
call fcn.00405b00
test al, al
je 0x41ad07
lea edx, [ebp - 0x50c]
push edx
call fcn.005487bf
add esp, 4
xor ecx, ecx
push 0x600
mov dword [ebp - 0x152c], 0x780061
mov dword [ebp - 0x1528], 0x760063
mov dword [ebp - 0x1524], 0x32006a
mov dword [ebp - 0x1520], 0x340033
mov dword [ebp - 0x151c], 0x300038
mov dword [ebp - 0x1518], 0x730039
mov dword [ebp - 0x1514], 0x660064
mov dword [ebp - 0x1510], 0x400040
mov dword [ebp - 0x150c], 0x310040
mov dword [ebp - 0x1508], 0x310032
mov dword [ebp - 0x1504], 0x310033
mov dword [ebp - 0x1500], 0x73006b
mov dword [ebp - 0x14fc], 0x6b0064
mov dword [ebp - 0x14f8], 0x78006c
mov dword [ebp - 0x14f4], 0x760063
mov dword [ebp - 0x14f0], 0x3b006b
mov dword [ebp - 0x14ec], 0x73006c
mov dword [ebp - 0x14e8], 0x660064
mov dword [ebp - 0x14e4], 0x6b
mov dword [ebp - 0x14c4], 0x7e0023
mov dword [ebp - 0x14c0], 0x7e007e
mov dword [ebp - 0x14bc], 0x58007e
mov dword [ebp - 0x14b8], 0x670069
mov dword [ebp - 0x14b4], 0x63006e
mov dword [ebp - 0x14b0], 0x64006f
mov dword [ebp - 0x14ac], 0x330065
mov dword [ebp - 0x14a8], 0x7e007e
mov dword [ebp - 0x14a4], 0x7e007e
mov dword [ebp - 0x14a0], 0x41007e
mov dword [ebp - 0x149c], 0x65006c
mov dword [ebp - 0x1498], 0x740072
mov dword [ebp - 0x1494], 0x7e007e
mov dword [ebp - 0x1490], 0x7e007e
mov dword [ebp - 0x148c], 0x7e007e
mov dword [ebp - 0x1488], 0x23007e
mov word [ebp - 0x1484], cx
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x41acb9
lea edx, [ebp - 0x152c]
push edx
mov edx, esi
call fcn.004049f0
lea eax, [ebp - 0x14c4]
add esp, 4
push eax
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 4
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call edi
push 0xffffffffffffffff
push 0x619914
push 0x619914
lea ecx, [ebp - 0x3c]
push ecx
push 0x39
lea edx, [ebp - 0x24]
push 0x4d
push edx
mov dword [ebp - 0x24], 0x73736463
mov word [ebp - 0x20], 0x6473
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x3c], 0x65657073
mov dword [ebp - 0x38], 0x61682064
mov word [ebp - 0x34], 0x6b63
mov byte [ebp - 0x32], bl
call fcn.00408b50
add esp, 0x1c
call fcn.00412730
jmp 0x41ad10
cmp byte [ebp - 0x15a1], 1
jne 0x41ad7c
mov eax, dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0054878c
push ebx
push ebx
call fcn.0043f1d0
mov edx, dword [ebp - 0x15bc]
add esp, 0x10
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 0x15a8], ebx
je 0x41a20a
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41ad5a
push eax
call edi
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41a20a
push eax
call edi
mov esi, dword [ebp - 0x15a0]
mov dword [ebp - 0x15b8], ebx
jmp 0x418ab3
cmp dword [ebp - 0x15a8], ebx
je 0x41b76b
xor esi, esi
lea ebx, [ebx]
mov eax, dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0054878c
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x41ae0b
inc esi
cmp esi, 0x64
jl 0x41ad90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
je 0x41adf4
cmp esi, ebx
je 0x41ae0b
push ebx
push ebx
call fcn.0043f1d0
mov edx, dword [ebp - 0x15bc]
add esp, 8
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, 0x61c1b0
call fcn.00430d50
mov esi, dword [ebp - 0x15a0]
add esp, 4
jmp 0x418ab3
cmp esi, ebx
je 0x41ae0b
cmp esi, 0x20
jne 0x41b000
mov dword [ebp - 0x15d0], 1
lea ecx, [ebp - 0x15ac]
call fcn.00406d90
lea ecx, [ebp - 0x153c]
push ecx
mov dword [ebp - 4], ebx
call fcn.0056c160
mov ecx, dword [0x64d978]
add esp, 4
push ebx
push 7
call fcn.0043efa0
call fcn.0043dd50
mov ecx, dword [0x64d978]
add esp, 8
push 0x10
call fcn.0043efa0
add eax, 8
push eax
lea edx, [ebp - 0x153c]
push edx
call fcn.0056bf30
mov ecx, dword [0x64d978]
add esp, 0xc
push 0x10
call fcn.0043efa0
lea edi, [eax + 8]
call fcn.0043ef60
mov ecx, dword [0x64d978]
add esp, 4
push 0x10
call fcn.0043efa0
add eax, 8
push eax
lea eax, [ebp - 0x153c]
push eax
call fcn.0056bf30
mov ecx, dword [0x64d978]
add esp, 0xc
push 0x10
call fcn.0043efa0
lea edi, [eax + 8]
call fcn.0043ef60
mov ecx, dword [0x64d978]
add esp, 4
push ebx
call fcn.0043efa0
mov ecx, 7
call fcn.0043ddc0
add esp, 4
lea ecx, [ebp - 0x153c]
push ecx
lea edx, [ebp - 0x64]
push edx
call fcn.0056c010
xor ecx, ecx
add esp, 8
mov word [ebp - 0x20], cx
xor eax, eax
push 0x61ba84
lea ecx, [ebp - 0x15ac]
mov dword [ebp - 0x28], 0x300025
mov dword [ebp - 0x24], 0x580032
mov dword [ebp - 0x3c], 0x300025
mov dword [ebp - 0x38], 0x580038
mov word [ebp - 0x34], ax
call fcn.0040a300
lea eax, [ebp - 0x64]
dec eax
mov esi, 1
mov dword [ebp - 0x15a8], eax
mov ecx, dword [ebp - 0x15a8]
movzx edx, byte [ecx + esi]
push edx
lea eax, [ebp - 0x28]
push eax
lea edi, [ebp - 0x15ac]
call fcn.00406950
mov ecx, dword [ebp - 0x15a8]
mov edx, esi
add esp, 8
and edx, reloc.WS2_32.dll_closesocket
mov byte [ecx + esi], bl
jns 0x41af56
dec edx
or edx, 0xfffffffc
inc edx
jne 0x41af70
lea eax, [esi - 1]
cmp eax, 0x13
jge 0x41af70
push 0x61c210
lea ecx, [ebp - 0x15ac]
call fcn.0040a300
mov eax, esi
cdq
mov ecx, 0xc
idiv ecx
test edx, edx
jne 0x41afb0
lea edx, [esi - 1]
cmp edx, 0x13
jge 0x41afb0
mov eax, dword [ebp - 0x15b4]
xor eax, 0x5b429d65
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea edi, [ebp - 0x15ac]
call fcn.00406950
add esp, 8
push 0x61c210
mov ecx, edi
call fcn.0040a300
inc esi
lea edx, [esi - 1]
cmp edx, 0x14
jl 0x41af21
push 0x61ba94
lea ecx, [ebp - 0x15ac]
call fcn.0040a300
lea ecx, [ebp - 0x15ac]
call fcn.0040a340
push eax
call fcn.0043f0f0
add esp, 4
test eax, eax
je 0x41b5aa
mov esi, dword [0x64eec0]
cmp esi, ebx
jne 0x41b048
mov eax, dword [0x64eebc]
cmp eax, ebx
jne 0x41b032
xor esi, esi
jmp 0x41b048
push ebx
push ebx
call fcn.0043f1d0
mov eax, dword [ebp - 0x15bc]
add esp, 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
mov edi, 0x61c1e0
call fcn.00430d50
mov esi, dword [ebp - 0x15a0]
add esp, 4
jmp 0x418ab3
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x64eec0], eax
mov esi, eax
mov ecx, dword [ebp - 0x15d8]
mov dword [esi + 0x4002a4], 0x134da7e
call fcn.0043efa0
mov edx, dword [eax + 0xb8]
mov ecx, 0x4c
mov edi, esi
mov dword [ebp - 0x15a8], eax
call fcn.0043afb0
cmp byte [0x64dbb6], 1
jne 0x41b08a
mov ecx, 1
xor edx, edx
call fcn.0043afb0
mov eax, dword [ebp - 0x15e0]
push 0x64d7e8
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0xffffffff
mov ecx, dword [ebp - 0x15b0]
lea edx, [esi + 0x58]
push 0x20
push edx
mov dword [esi + 0x54], ecx
call fcn.00545549
mov ecx, dword [0x64dbcc]
add esp, 0xc
cmp ecx, ebx
je 0x41b0d6
lea edi, [esi + 0x9c]
mov edx, 0x64dbd0
mov dword [esi + 0x98], ecx
call fcn.0043afb0
mov ecx, dword [0x64ddd0]
cmp ecx, ebx
je 0x41b0f7
mov edx, dword [0x64ddd4]
lea edi, [esi + 0x2a0]
mov dword [esi + 0x29c], ecx
call fcn.0043afb0
mov eax, dword [ebp - 0x15a8]
mov ecx, dword [eax + 0x2c]
mov dword [esi + 0x4002a8], ecx
lea edx, [eax + 0x30]
lea edi, [esi + 0x4002ac]
mov ecx, 0x80
call fcn.0043afb0
mov edx, dword [ebp - 0x15a8]
mov edx, dword [edx + 0xb4]
lea edi, [esi + 0x40032c]
mov ecx, 0x1d9
call fcn.0043afb0
mov ecx, dword [0x64ddd8]
call fcn.0043efa0
lea edi, [esi + 0x400505]
mov ecx, 0x14
mov edx, eax
call fcn.0043afb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x400519], eax
mov eax, dword [ebp - 0x15ec]
mov cl, byte [eax + 0xa1f]
mov byte [esi + 0x40051d], cl
lea edx, [eax + 0xa20]
lea edi, [esi + 0x40051e]
mov ecx, 0x100
call fcn.0043afb0
mov eax, dword [ebp - 0x15ec]
mov dl, byte [eax + 0xb20]
mov byte [esi + 0x40061e], dl
lea edx, [eax + 0xb21]
lea edi, [esi + 0x40061f]
mov ecx, 0x100
call fcn.0043afb0
mov eax, dword [ebp - 0x15a8]
mov dword [esi + 0x4002a0], ebx
cmp dword [eax + 8], 4
jne 0x41b261
xor eax, eax
lea ecx, [ebp - 0x15a8]
mov dword [ebp - 0x8c], 0x690057
mov dword [ebp - 0x88], 0x44006e
mov dword [ebp - 0x84], 0x73006f
mov dword [ebp - 0x80], 0x640047
mov dword [ebp - 0x7c], 0x5f0069
mov dword [ebp - 0x78], 0x300025
mov dword [ebp - 0x74], 0x580038
mov word [ebp - 0x70], ax
call fcn.00406d90
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x15b4]
xor ecx, 0x2b429d65
push ecx
lea edx, [ebp - 0x8c]
push edx
lea edi, [ebp - 0x15a8]
call fcn.00406950
add esp, 8
mov ecx, edi
call fcn.0040a340
push eax
push 0x80
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, edi
mov dword [0x64ddf4], eax
call fcn.00406970
mov ecx, edi
call fcn.00406de0
mov eax, dword [ebp - 0x15b8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [0x64dbb6], bl
je 0x41b295
mov ecx, 1
xor edx, edx
mov edi, esi
call fcn.0043afb0
mov dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x4002a4], 0x42e576f7
xor edi, edi
cmp dword [esi + 0x50], 0xffffffff
jne 0x41b2bf
lea ecx, [ecx]
cmp dword [esi + 0x4002a0], ebx
jne 0x41b2bf
cmp edi, 0xbb8
jge 0x41b2bf
push 1
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x50], 0xffffffff
je 0x41b2a0
push 0xc6
lea edx, [ebp - 0x4ca]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x4cc], cx
call fcn.0054b8b0
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0xd5b]
push ebx
push eax
mov byte [ebp - 0xd5c], bl
call fcn.0054b8b0
xor edx, edx
mov dword [ebp - 0x50], 0x4c6e6957
mov dword [ebp - 0x4c], 0x6e656369
mov word [ebp - 0x48], 0x6573
mov byte [ebp - 0x46], bl
mov dword [ebp - 0xa8], 0x690057
mov dword [ebp - 0xa4], 0x4c006e
mov dword [ebp - 0xa0], 0x630069
mov dword [ebp - 0x9c], 0x6e0065
mov dword [ebp - 0x98], 0x650073
mov word [ebp - 0x94], dx
mov dword [ebp - 0x14b0], 0x546e7552
mov dword [ebp - 0x14ac], 0x20656d69
mov dword [ebp - 0x14a8], 0x6f727245
mov dword [ebp - 0x14a4], 0x50202e72
mov dword [ebp - 0x14a0], 0x7361656c
mov dword [ebp - 0x149c], 0x72202c65
mov dword [ebp - 0x1498], 0x6e692d65
mov dword [ebp - 0x1494], 0x6c617473
mov dword [ebp - 0x1490], 0x6874206c
mov dword [ebp - 0x148c], 0x61207369
mov dword [ebp - 0x1488], 0x696c7070
mov dword [ebp - 0x1484], 0x69746163
mov dword [ebp - 0x1480], 0x2e6e6f
mov edi, dword [esi + 0x50]
mov esi, dword [esi + 0x4002a0]
add esp, 0xc
cmp edi, 0x4d236ad
ja 0x41b46f
je 0x41b3f4
cmp edi, ebx
jbe 0x41b474
cmp edi, 2
ja 0x41b474
mov byte [ebp - 0x15bd], 1
cmp esi, 0x134da7e
je 0x41b5fd
cmp edi, 0x4d236ad
jne 0x41b5fd
mov eax, dword [ebp - 0x15bc]
push ebx
push eax
mov byte [ebp - 0x15bd], bl
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b43e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b455
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
lea ecx, [ebp - 0x14b0]
push ecx
lea edx, [ebp - 0xd5c]
call fcn.00438660
add esp, 4
jmp 0x41b58e
cmp edi, 0xffffffff
je 0x41b4e6
mov edx, dword [ebp - 0x15bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b499
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b4b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
push edi
push str.File_corrupted_._This_application_has_been_manipulated_and_maybe_r_nits_infected_by_a_Virus_or_cracked._This_application_wont_work_anymore._r_nError:_08X
lea edx, [ebp - 0x4cc]
call fcn.00438680
mov edx, dword [0x64d970]
add esp, 8
push 0x10
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x4cc]
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41b5fd
cmp word [ebp - 0x95c], bx
je 0x41b5fd
cmp word [ebp - 0x95a], bx
je 0x41b5fd
mov eax, dword [ebp - 0x15bc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b525
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b53c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
mov edi, dword [ebp - 0x15c8]
cmp edi, ebx
jne 0x41b54a
xor eax, eax
jmp 0x41b573
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41b55d
xor eax, eax
jmp 0x41b573
lea esi, [eax + eax]
mov eax, esi
call fcn.0054cb20
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.0043a980
lea ecx, [ebp - 0x754]
push ecx
push eax
push str.Cannot_find__s._Please__re_install_this_application._r_nMissing_file_path:_s
lea edx, [ebp - 0xd5c]
call fcn.00438660
add esp, 0xc
mov ecx, dword [0x64d970]
push 0x10
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0xd5c]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41b5fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x15bc]
push ebx
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 2
mov edi, 0x61c398
call fcn.00430d50
mov eax, dword [ebp - 0x15bc]
add esp, 4
cmp eax, ebx
je 0x41b5e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b5fd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
call fcn.0043f130
lea ecx, [ebp - 0x15ac]
call fcn.00406970
lea ecx, [ebp - 0x15ac]
mov dword [ebp - 4], 0xffffffff
call fcn.00406de0
cmp byte [ebp - 0x15bd], bl
je 0x41b8c5
mov eax, dword [ebp - 0x15b0]
mov edi, dword [sym.imp.USER32.dll_EnumThreadWindows]
lea edx, [ebp - 0x15e4]
push edx
push 0x4122c0
push eax
mov dword [ebp - 0xa8], 0x69006c
mov dword [ebp - 0xa4], 0x65006e
mov dword [ebp - 0xa0], 0x670061
mov dword [ebp - 0x9c], 0x2e0065
mov dword [ebp - 0x98], 0x660063
mov dword [ebp - 0x94], 0x67
xor esi, esi
mov dword [ebp - 0x15e4], ebx
mov dword [ebp - 0x15e0], ebx
call edi
test eax, eax
je 0x41b6be
cmp esi, 0x1388
jge 0x41b6be
push 1
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x15b0]
lea ecx, [ebp - 0x15e4]
push ecx
push 0x4122c0
push edx
call edi
test eax, eax
jne 0x41b694
mov eax, dword [ebp - 0x15e4]
cmp eax, ebx
je 0x41b832
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [ebp - 0x15b0]
je 0x41b8c5
cmp dword [ebp - 0x15e0], 1
je 0x41b8c5
mov ecx, dword [ebp - 0x15bc]
lea eax, [ebp - 0x15cc]
push eax
push ecx
mov dword [ebp - 0x15cc], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41b7f1
mov edx, dword [ebp - 0x15bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
mov esi, eax
mov edi, 0x61c40c
call fcn.00430d50
mov eax, dword [ebp - 0x15bc]
add esp, 4
cmp eax, ebx
je 0x41b74b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b8c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
jmp 0x41b8c5
xor edi, edi
lea ecx, [ecx]
mov eax, dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0054878c
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x41b7df
inc edi
cmp edi, 0x64
jl 0x41b770
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
je 0x41b7a9
cmp eax, ebx
je 0x41b7df
push esi
mov edi, 0x61c3ac
jmp 0x41b7d5
cmp eax, ebx
je 0x41b7df
cmp eax, 0x20
jne 0x41b7ce
mov esi, dword [ebp - 0x15cc]
mov dword [ebp - 0x15d0], 1
push 1
mov edi, 0x61c398
jmp 0x41b8bd
push 0xffffffffffffffff
mov edi, 0x61c3dc
mov esi, eax
call fcn.00430d50
add esp, 4
mov esi, dword [ebp - 0x15cc]
push 1
mov edi, 0x61c398
jmp 0x41b8bd
cmp dword [ebp - 0x15cc], 0x103
jne 0x41b820
mov esi, dword [ebp - 0x15a0]
mov eax, dword [esi + 0x2d8]
cmp eax, 3
jl 0x41b843
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
mov edi, 0x61c398
jmp 0x41b8bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov edi, 0x61c428
jmp 0x41b8bb
mov esi, dword [ebp - 0x15a0]
mov eax, dword [esi + 0x2d8]
cmp eax, 3
jge 0x41b8ae
inc eax
mov dword [esi + 0x2d8], eax
mov eax, dword [ebp - 0x15bc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b86f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b886
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
cmp dword [esi + 0x2d8], 2
jne 0x41b89e
lea ecx, [ebp - 0xa8]
push ecx
call fcn.005487ef
add esp, 4
mov edx, dword [ebp - 0x15d8]
push edx
mov ecx, esi
call fcn.00418a40
jmp 0x41b8c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xb
mov edi, 0x61c448
mov esi, eax
call fcn.00430d50
add esp, 4
cmp dword [ebp - 0x15d0], ebx
je 0x41b92a
xor esi, esi
nop
mov eax, dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0054878c
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x41b92a
inc esi
cmp esi, 0x64
jl 0x41b8d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
je 0x41b90b
cmp esi, ebx
je 0x41b92a
push edi
mov edi, 0x61c460
jmp 0x41b922
cmp esi, ebx
je 0x41b92a
push 0xffffffffffffffff
cmp esi, 0x20
jne 0x41b91d
mov edi, 0x61c490
jmp 0x41b922
mov edi, 0x61c4c0
call fcn.00430d50
add esp, 4
cmp byte [0x64dbb6], bl
je 0x41b97d
mov edx, dword [ebp - 0x15bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b957
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41a20a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x15a0]
mov dword [ebp - 0x15b8], ebx
jmp 0x418ab3
mov eax, dword [ebp - 0x15bc]
cmp eax, ebx
je 0x41b994
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15bc], ebx
mov eax, dword [ebp - 0x15b8]
cmp eax, ebx
je 0x41b9ab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x15b8], ebx
push ebx
push ebx
call fcn.0043f1d0
mov esi, dword [ebp - 0x15a0]
add esp, 8
jmp 0x418ab3
mov edx, dword [edi + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b9ef
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41b9e3
mov ecx, edi
call fcn.00450ac7
mov ecx, edi
call fcn.0045868a
jmp 0x418ab8
mov eax, edi
call fcn.004261c0
jmp 0x419e41