Function at 0x4711f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create thread
Delete registry key
Move file
Persist via application shimming
Query or enumerate registry value
Read .ini file
Read file on windows
Resume thread
Set registry value
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1f06
mov eax, dword fs:[0]
push eax
mov eax, 0x163c
call fcn.005c8e60
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x15a8], esi
mov eax, dword [ebp + 8]
mov ecx, dword [0x680408]
mov dword [ebp - 0x15e4], eax
call fcn.004940f0
mov ecx, dword [0x6803fc]
mov edi, eax
call fcn.004940f0
test edi, edi
je 0x474271
test eax, eax
je 0x474271
cmp edi, eax
je 0x471265
mov ecx, esi
jmp 0x473500
mov ecx, dword [0x680404]
call fcn.004940f0
mov ecx, dword [0x6803f8]
mov edi, eax
call fcn.004940f0
test edi, edi
je 0x47125e
test eax, eax
je 0x47125e
cmp edi, 2
jb 0x47125e
cmp eax, 2
jb 0x47125e
cmp edi, eax
jne 0x47125e
mov ecx, dword [0x680400]
call fcn.004940f0
mov ecx, dword [0x6803f4]
mov edi, eax
call fcn.004940f0
test edi, edi
je 0x47125e
test eax, eax
je 0x47125e
cmp edi, eax
jne 0x47125e
mov dword [ebp - 0x194], 0x720045
mov dword [ebp - 0x190], 0x6f0072
mov dword [ebp - 0x18c], 0x72
mov dword [ebp - 0x348], 0x70004f
mov dword [ebp - 0x344], 0x720065
mov dword [ebp - 0x340], 0x740061
mov dword [ebp - 0x33c], 0x6e0069
mov dword [ebp - 0x338], 0x200067
mov dword [ebp - 0x334], 0x790073
mov dword [ebp - 0x330], 0x740073
mov dword [ebp - 0x32c], 0x6d0065
mov dword [ebp - 0x328], 0x610020
mov dword [ebp - 0x324], 0x6e0062
mov dword [ebp - 0x320], 0x72006f
mov dword [ebp - 0x31c], 0x61006d
mov dword [ebp - 0x318], 0x6c
call fcn.004709c0
test eax, eax
je 0x4713ff
push 0xffffffffffffffff
push 0x649256
push 0x649256
push 0x649256
push 0x3a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x73736463
push 0x4d
push eax
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], 0
call fcn.00462b80
add esp, 0x1c
push 0x600
call fcn.0049a300
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
test esi, esi
je 0x4713e9
lea eax, [ebp - 0x348]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x194]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x465870
push 0
push 0
call edi
jmp 0x473505
xor eax, eax
mov dword [ebp - 0x3b4], 0x410048
mov word [ebp - 0x284], ax
mov word [ebp - 0x1ec], ax
mov word [ebp - 0x174], ax
mov word [ebp - 0x234], ax
mov word [ebp - 0xe4], ax
lea eax, [ebp - 0x15e8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x3b4]
mov dword [ebp - 0x3b0], 0x440052
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x3ac], 0x410057
mov dword [ebp - 0x3a8], 0x450052
mov dword [ebp - 0x3a4], 0x44005c
mov dword [ebp - 0x3a0], 0x530045
mov dword [ebp - 0x39c], 0x520043
mov dword [ebp - 0x398], 0x500049
mov dword [ebp - 0x394], 0x490054
mov dword [ebp - 0x390], 0x4e004f
mov dword [ebp - 0x38c], 0x53005c
mov dword [ebp - 0x388], 0x730079
mov dword [ebp - 0x384], 0x650074
mov dword [ebp - 0x380], 0x6d
mov dword [ebp - 0x37c], 0x410048
mov dword [ebp - 0x378], 0x440052
mov dword [ebp - 0x374], 0x410057
mov dword [ebp - 0x370], 0x450052
mov dword [ebp - 0x36c], 0x41005c
mov dword [ebp - 0x368], 0x500043
mov dword [ebp - 0x364], 0x5c0049
mov dword [ebp - 0x360], 0x530044
mov dword [ebp - 0x35c], 0x540044
mov dword [ebp - 0x358], 0x56005c
mov dword [ebp - 0x354], 0x4f0042
mov dword [ebp - 0x350], 0x5f0058
mov dword [ebp - 0x34c], 0x5f
mov dword [ebp - 0x2a8], 0x410048
mov dword [ebp - 0x2a4], 0x440052
mov dword [ebp - 0x2a0], 0x410057
mov dword [ebp - 0x29c], 0x450052
mov dword [ebp - 0x298], 0x41005c
mov dword [ebp - 0x294], 0x500043
mov dword [ebp - 0x290], 0x5c0049
mov dword [ebp - 0x28c], 0x530044
mov dword [ebp - 0x288], 0x540044
mov dword [ebp - 0x230], 0x790053
mov dword [ebp - 0x22c], 0x740073
mov dword [ebp - 0x228], 0x6d0065
mov dword [ebp - 0x224], 0x690042
mov dword [ebp - 0x220], 0x73006f
mov dword [ebp - 0x21c], 0x650056
mov dword [ebp - 0x218], 0x730072
mov dword [ebp - 0x214], 0x6f0069
mov dword [ebp - 0x210], 0x6e
mov dword [ebp - 0x20c], 0x690056
mov dword [ebp - 0x208], 0x650064
mov dword [ebp - 0x204], 0x42006f
mov dword [ebp - 0x200], 0x6f0069
mov dword [ebp - 0x1fc], 0x560073
mov dword [ebp - 0x1f8], 0x720065
mov dword [ebp - 0x1f4], 0x690073
mov dword [ebp - 0x1f0], 0x6e006f
mov dword [ebp - 0x17c], 0x420056
mov dword [ebp - 0x178], 0x58004f
mov dword [ebp - 0x248], 0x690056
mov dword [ebp - 0x244], 0x740072
mov dword [ebp - 0x240], 0x610075
mov dword [ebp - 0x23c], 0x42006c
mov dword [ebp - 0x238], 0x78006f
mov dword [ebp - 0xec], 0x4f0058
mov dword [ebp - 0xe8], 0x560042
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471892
push 0x207
push eax
mov byte [ebp - 0x5ec], al
lea eax, [ebp - 0x5eb]
push eax
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x15d4], 7
lea eax, [ebp - 0x15d8]
mov dword [ebp - 0x15d8], 0x208
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x15d4]
push eax
push 0
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x15e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x47188a
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.005c1fb8
add esp, 8
test eax, eax
je 0x471777
lea ecx, [ebp - 0xec]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x471742
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xec]
push eax
push 7
push 0
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x15e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x208
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x15d8], 0x208
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x15d4]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x15e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47188a
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.005c1fb8
add esp, 8
test eax, eax
je 0x471825
lea ecx, [ebp - 0xec]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4717f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xec]
push eax
push 7
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x15e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x15d0]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x37c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47188a
push dword [ebp - 0x15d0]
call edi
lea eax, [ebp - 0x15d0]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x2a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47188a
push eax
push dword [ebp - 0x15d0]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x15d0]
call edi
push dword [ebp - 0x15e8]
call edi
movdqa xmm0, xmmword [0x64e650]
xor eax, eax
mov word [ebp - 0x2b0], ax
mov byte [ebp - 0xa4], al
mov byte [ebp - 0x644], al
mov byte [ebp - 0x630], al
lea eax, [ebp - 0xb0]
movdqu xmmword [ebp - 0x654], xmm0
push eax
movdqa xmm0, xmmword [0x64e4d0]
mov dword [ebp - 0x134], 0x720045
mov dword [ebp - 0x130], 0x6f0072
mov dword [ebp - 0x12c], 0x72
mov dword [ebp - 0x314], 0x6f0059
mov dword [ebp - 0x310], 0x720075
mov dword [ebp - 0x30c], 0x630020
mov dword [ebp - 0x308], 0x6d006f
mov dword [ebp - 0x304], 0x750070
mov dword [ebp - 0x300], 0x650074
mov dword [ebp - 0x2fc], 0x200072
mov dword [ebp - 0x2f8], 0x61006d
mov dword [ebp - 0x2f4], 0x200079
mov dword [ebp - 0x2f0], 0x650062
mov dword [ebp - 0x2ec], 0x690020
mov dword [ebp - 0x2e8], 0x66006e
mov dword [ebp - 0x2e4], 0x630065
mov dword [ebp - 0x2e0], 0x650074
mov dword [ebp - 0x2dc], 0x200064
mov dword [ebp - 0x2d8], 0x790062
mov dword [ebp - 0x2d4], 0x610020
mov dword [ebp - 0x2d0], 0x630020
mov dword [ebp - 0x2cc], 0x6d006f
mov dword [ebp - 0x2c8], 0x750070
mov dword [ebp - 0x2c4], 0x650074
mov dword [ebp - 0x2c0], 0x200072
mov dword [ebp - 0x2bc], 0x690076
mov dword [ebp - 0x2b8], 0x750072
mov dword [ebp - 0x2b4], 0x2e0073
mov dword [ebp - 0xb0], 0x534e4957
mov dword [ebp - 0xac], 0x4c4f4f50
mov dword [ebp - 0xa8], 0x5652442e
movdqu xmmword [ebp - 0x640], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x471bfd
push 0x1ff
lea eax, [ebp - 0x5e3]
mov byte [ebp - 0x5e4], 0
push 0
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x5e4]
push 0x200
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x471aec
push 0xffffffffffffffff
push 0x649256
push 0x649256
push 0x649256
push 0x3b
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x1c]
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
call fcn.00462b80
add esp, 0x1c
push 0x600
call fcn.0049a300
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
test esi, esi
je 0x471ad6
lea eax, [ebp - 0x314]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x134]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x465870
push 0
push 0
call edi
jmp 0x473505
lea edi, [ebp - 0x5e4]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x471af5
sub edi, ecx
je 0x471b25
xor esi, esi
movsx eax, byte [ebp + esi - 0x5e4]
push eax
call fcn.005c4c00
mov byte [ebp + esi - 0x5e4], al
add esp, 4
inc esi
cmp esi, edi
jb 0x471b02
mov esi, dword [ebp - 0x15a8]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x5e4]
push eax
call fcn.005c1030
add esp, 8
test eax, eax
jne 0x471bfd
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x5e4]
push eax
call fcn.005c1030
add esp, 8
test eax, eax
jne 0x471bfd
push 0xffffffffffffffff
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x5e4]
push eax
push 0x649256
push 0x649256
push 0x3c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x73736463
push 0x4d
push eax
mov word [ebp - 0x18], 0x6473
call fcn.00462b80
add esp, 0x1c
push 0x600
call fcn.0049a300
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
test esi, esi
je 0x471be7
lea eax, [ebp - 0x314]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x134]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x465870
push 0
push 0
call edi
jmp 0x473505
lea edx, [esi + 0x184]
mov ecx, esi
call fcn.00494320
call fcn.0046bc20
mov ecx, dword [0x6803c0]
call fcn.004940f0
movdqa xmm0, xmmword [0x64e370]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x15d8], esi
mov word [ebp - 0x198], ax
mov byte [ebp - 0x64], al
mov byte [ebp - 0x94], al
mov byte [ebp - 0xc2], al
mov byte [ebp - 0xd2], al
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x1c8], 0x610043
push eax
mov dword [ebp - 0x1c4], 0x27006e
mov dword [ebp - 0x1c0], 0x200074
mov dword [ebp - 0x1bc], 0x740053
mov dword [ebp - 0x1b8], 0x720061
mov dword [ebp - 0x1b4], 0x200074
mov dword [ebp - 0x1b0], 0x610047
mov dword [ebp - 0x1ac], 0x65006d
mov dword [ebp - 0x1a8], 0x430020
mov dword [ebp - 0x1a4], 0x69006c
mov dword [ebp - 0x1a0], 0x6e0065
mov dword [ebp - 0x19c], 0x2e0074
mov dword [ebp - 0x100], 0x720045
mov dword [ebp - 0xfc], 0x6f0072
mov dword [ebp - 0xf8], 0x72
mov dword [ebp - 0x70], 0x6e72656b
mov dword [ebp - 0x6c], 0x32336c65
mov dword [ebp - 0x68], 0x6c6c642e
mov dword [ebp - 0xa0], 0x54746547
mov dword [ebp - 0x9c], 0x436b6369
mov dword [ebp - 0x98], 0x746e756f
movdqu xmmword [ebp - 0x3cc], xmm0
mov dword [ebp - 0x3bc], 0x6e756f43
mov dword [ebp - 0x3b8], 0x726574
mov dword [ebp - 0xd0], 0x61657243
mov dword [ebp - 0xcc], 0x72506574
mov dword [ebp - 0xc8], 0x7365636f
mov word [ebp - 0xc4], 0x4173
mov dword [ebp - 0xe0], 0x61657243
mov dword [ebp - 0xdc], 0x72506574
mov dword [ebp - 0xd8], 0x7365636f
mov word [ebp - 0xd4], 0x5773
call fcn.00401240
mov edi, eax
test edi, edi
je 0x471ec9
cmp byte [edi], 0xe9
jne 0x471ec9
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov esi, eax
add esp, 4
test esi, esi
je 0x471dfc
lea eax, [ebp - 0x1c8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x100]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x45ad30
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x471e02
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1ff
lea eax, [ebp - 0x5e3]
mov dword [ebp - 0x15b0], 0
push 0
push eax
mov byte [ebp - 0x5e4], 0
call fcn.005c7c50
add esp, 0xc
xor eax, eax
mov word [ebp - 0xb6c], ax
push 0x206
push eax
lea eax, [ebp - 0xb6a]
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x15b0]
lea edx, [ebp - 0x5e4]
push eax
push ecx
lea eax, [ebp - 0xb6c]
push eax
push ecx
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.0045b010
lea ecx, [ebp - 0x5e4]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471e74
sub ecx, edx
je 0x471eb3
push 0xffffffffffffffff
lea eax, [ebp - 0x5e4]
mov byte [ebp - 0x16], 0
push eax
push 0x649256
push 0x649256
push 0x3d
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x6473
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
call fcn.00462b80
add esp, 0x1c
push 0
push 0
push 0
push 0x465870
push 0
push 0
call esi
jmp 0x473505
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00401240
mov edi, eax
test edi, edi
je 0x471fd8
cmp byte [edi], 0xe9
jne 0x471fd8
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov esi, eax
add esp, 4
test esi, esi
je 0x471f4a
lea eax, [ebp - 0x1c8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x100]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x45ad30
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x471f50
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1ff
lea eax, [ebp - 0x5e3]
mov dword [ebp - 0x15b0], 0
push 0
push eax
mov byte [ebp - 0x5e4], 0
call fcn.005c7c50
add esp, 0xc
xor eax, eax
mov word [ebp - 0xb6c], ax
push 0x206
push eax
lea eax, [ebp - 0xb6a]
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x15b0]
lea edx, [ebp - 0x5e4]
push eax
push ecx
lea eax, [ebp - 0xb6c]
push eax
push ecx
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.0045b010
lea ecx, [ebp - 0x5e4]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x471fc2
sub ecx, edx
je 0x471eb3
push 0xfffffffffffffffe
jmp 0x471e81
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00401240
mov edi, eax
test edi, edi
je 0x4720e7
cmp byte [edi], 0xe9
jne 0x4720e7
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov esi, eax
add esp, 4
test esi, esi
je 0x472059
lea eax, [ebp - 0x1c8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x100]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x45ad30
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47205f
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1ff
lea eax, [ebp - 0x5e3]
mov dword [ebp - 0x15b0], 0
push 0
push eax
mov byte [ebp - 0x5e4], 0
call fcn.005c7c50
add esp, 0xc
xor eax, eax
mov word [ebp - 0xb6c], ax
push 0x206
push eax
lea eax, [ebp - 0xb6a]
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x15b0]
lea edx, [ebp - 0x5e4]
push eax
push ecx
lea eax, [ebp - 0xb6c]
push eax
push ecx
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.0045b010
lea ecx, [ebp - 0x5e4]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4720d1
sub ecx, edx
je 0x471eb3
push 0xfffffffffffffffd
jmp 0x471e81
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00401240
mov edi, eax
test edi, edi
je 0x4721f6
cmp byte [edi], 0xe9
jne 0x4721f6
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov esi, eax
add esp, 4
test esi, esi
je 0x472168
lea eax, [ebp - 0x1c8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x100]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x45ad30
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47216e
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1ff
lea eax, [ebp - 0x5e3]
mov dword [ebp - 0x15b0], 0
push 0
push eax
mov byte [ebp - 0x5e4], 0
call fcn.005c7c50
add esp, 0xc
xor eax, eax
mov word [ebp - 0xb6c], ax
push 0x206
push eax
lea eax, [ebp - 0xb6a]
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x15b0]
lea edx, [ebp - 0x5e4]
push eax
push ecx
lea eax, [ebp - 0xb6c]
push eax
push ecx
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.0045b010
lea ecx, [ebp - 0x5e4]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4721e0
sub ecx, edx
je 0x471eb3
push 0xfffffffffffffffc
jmp 0x471e81
xor eax, eax
mov dword [ebp - 0x128], 0x730025
push 0x206
push eax
mov word [ebp - 0x120], ax
mov word [ebp - 0xf0], ax
mov dword [ebp - 0x15e0], eax
mov word [ebp - 0x1074], ax
lea eax, [ebp - 0x1072]
push eax
mov dword [ebp - 0x124], 0x730025
mov dword [ebp - 0xf4], 0x620072
mov dword [ebp - 0x1e8], 0x690046
mov dword [ebp - 0x1e4], 0x65006c
mov dword [ebp - 0x1e0], 0x630020
mov dword [ebp - 0x1dc], 0x72006f
mov dword [ebp - 0x1d8], 0x750072
mov dword [ebp - 0x1d4], 0x740070
mov dword [ebp - 0x1d0], 0x640065
mov dword [ebp - 0x1cc], 0x21
mov dword [ebp - 0x14c], 0x6f004c
mov dword [ebp - 0x148], 0x690067
mov dword [ebp - 0x144], 0x6e
call fcn.005c7c50
add esp, 0xc
lea eax, [esi + 0x4da]
mov dword [ebp - 0x15d0], eax
push eax
push 0x6806a0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x1074]
push eax
call fcn.00463930
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0x15e0]
push eax
call fcn.005c1930
mov eax, dword [ebp - 0x15e0]
add esp, 0x1c
test eax, eax
jne 0x472397
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
test esi, esi
je 0x472360
lea eax, [ebp - 0x1e8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x14c]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffb
push 0x649256
push 0x649256
push 0x649256
push 0x3d
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x73736463
push 0x4d
push eax
mov word [ebp - 0x18], 0x6473
mov byte [ebp - 0x16], 0
call fcn.00462b80
add esp, 0x1c
jmp 0x4713e9
push 2
push 0
push eax
call fcn.005c4057
add esp, 0xc
push dword [ebp - 0x15e0]
call fcn.005c446a
add esp, 4
mov esi, eax
push 0
push 0
push dword [ebp - 0x15e0]
call fcn.005c4057
add esp, 0xc
push esi
call fcn.0049a32d
add esp, 4
mov edi, eax
push dword [ebp - 0x15e0]
push 1
push esi
push edi
call fcn.005c469b
push dword [ebp - 0x15e0]
call fcn.005c1e76
add esp, 0x14
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x1544]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x84], xmm0
push eax
call fcn.0040c120
add esp, 4
lea eax, [ebp - 0x1544]
push esi
push edi
push eax
call fcn.0040bef0
add esp, 0xc
lea eax, [ebp - 0x1544]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040bfd0
push edi
call fcn.0049a336
add esp, 0xc
lea eax, [ebp - 0x14e4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x40], xmm0
push eax
call fcn.0040beb0
add esp, 4
lea eax, [ebp - 0x84]
push 0x14
push eax
lea eax, [ebp - 0x14e4]
push eax
call fcn.0040bca0
add esp, 0xc
lea eax, [ebp - 0x14e4]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040bd80
mov ecx, dword [ebp - 0x15e4]
add esp, 8
call fcn.004940f0
lea ecx, [ebp - 0x40]
mov esi, 0xc
lea edx, [eax + 0xc]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4741de
add ecx, 4
add edx, 4
sub esi, 4
jae 0x472494
mov ecx, dword [0x680410]
call fcn.004940f0
test eax, eax
je 0x47256e
mov ecx, dword [0x68040c]
call fcn.004940f0
test eax, eax
je 0x47256e
push 0x208
lea eax, [ebp - 0x1074]
push 0
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x1074]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x30
lea eax, [ebp - 0x1574]
push 0
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0x1574]
push eax
lea eax, [ebp - 0x1074]
push eax
call fcn.005c4d35
add esp, 8
test eax, eax
jne 0x472575
cmp dword [ebp - 0x1560], 0x6c5660
jl 0x472575
push 0xfffffffffffffff9
push 0x649256
push 0x649256
push 0x649256
push 0x3d
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x1c]
push 0x4d
push eax
mov dword [ebp - 0x1c], 0x73736463
mov word [ebp - 0x18], 0x6473
call fcn.00462b80
mov ecx, dword [ebp - 0x15a8]
add esp, 0x1c
call fcn.0047be60
push 0
call fcn.005c35aa
push 0xc
lea eax, [ebp - 0x15fc]
mov dword [ebp - 0x15fc], 0
push eax
xorps xmm0, xmm0
push 0
movq qword [ebp - 0x15f8], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
mov edi, dword [0x680440]
mov edx, dword [ebp - 0x15f8]
mov ecx, dword [ebp - 0x15fc]
add edx, ecx
cmp byte [edi], 0xe9
je 0x4725e1
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x15a8]
call fcn.0047be60
push 0
call fcn.005c35aa
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
cmp eax, ecx
jb 0x4725c4
cmp eax, edx
ja 0x4725c4
mov edi, dword [0x680424]
cmp byte [edi], 0xe9
jne 0x4725c4
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
cmp eax, ecx
jb 0x4725c4
cmp eax, edx
ja 0x4725c4
mov edi, dword [0x68041c]
cmp byte [edi], 0xe9
jne 0x4725c4
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
cmp eax, ecx
jb 0x4725c4
cmp eax, edx
ja 0x4725c4
mov edi, dword [0x680414]
cmp byte [edi], 0xe9
jne 0x4725c4
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
cmp eax, ecx
jb 0x4725c4
cmp eax, edx
ja 0x4725c4
push 0x44
lea eax, [ebp - 0x1644]
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x15c8], xmm0
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x1644], 0x44
xor eax, eax
mov word [ebp - 0x1484], ax
push 0x206
push eax
lea eax, [ebp - 0x1482]
push eax
call fcn.005c7c50
add esp, 0xc
xor eax, eax
mov word [ebp - 0x964], ax
push 0x206
push eax
lea eax, [ebp - 0x962]
push eax
call fcn.005c7c50
add esp, 0xc
mov byte [ebp - 0x75c], 0
lea eax, [ebp - 0x75b]
push 0x103
push 0
push eax
call fcn.005c7c50
add esp, 0xc
mov byte [ebp - 0x15b5], 0
mov dword [ebp - 0x4b4], 0xbeabb1be
mov dword [ebp - 0x4b0], 0xcad6bbaa
mov dword [ebp - 0x4ac], 0xcad5b2e1
mov dword [ebp - 0x4a8], 0xc2bc002e
mov dword [ebp - 0x4a4], 0xcec4b5c4
mov dword [ebp - 0x4a0], 0x71d5c2
mov dword [ebp - 0x49c], 0x650077
mov dword [ebp - 0x498], 0x740072
mov dword [ebp - 0x494], 0xd2d40079
mov dword [ebp - 0x490], 0xd1a9bfb4
mov dword [ebp - 0x48c], 0xc2db002e
mov dword [ebp - 0x488], 0xd4adccb3
mov dword [ebp - 0x484], 0x570051
mov dword [ebp - 0x480], 0x520045
mov dword [ebp - 0x47c], 0x590054
mov dword [ebp - 0x478], 0x690075
mov dword [ebp - 0x474], 0x70006f
mov dword [ebp - 0x470], 0xcec4b4b4
mov dword [ebp - 0x46c], 0xceaad5c2
mov dword [ebp - 0x468], 0xd7aad6f7
mov dword [ebp - 0x464], 0x62ccfb
mov dword [ebp - 0x460], 0x6d006e
mov dword [ebp - 0x45c], 0x48004b
mov dword [ebp - 0x458], 0x440046
mov dword [ebp - 0x454], 0xc2db0053
mov dword [ebp - 0x450], 0xbbf2ccb3
mov dword [ebp - 0x44c], 0xb9d8cfe0
mov dword [ebp - 0x448], 0xc2dbb5c4
mov dword [ebp - 0x444], 0xd7a2ccb3
mov dword [ebp - 0x440], 0xd3c3b2e1
mov dword [ebp - 0x43c], 0xcbf9bba7
mov dword [ebp - 0x438], 0xb5c4d3d0
mov dword [ebp - 0x434], 0xd7f7b9a4
mov dword [ebp - 0x430], 0xcbf9bcb0
mov dword [ebp - 0x42c], 0xcdf8d3d0
mov dword [ebp - 0x428], 0xb6d4d3d1
mov dword [ebp - 0x424], 0x310042
mov dword [ebp - 0x420], 0x330032
mov dword [ebp - 0x41c], 0x350034
mov dword [ebp - 0x418], 0x370036
mov dword [ebp - 0x414], 0x390038
mov dword [ebp - 0x410], 0xd6cad0d4
mov dword [ebp - 0x40c], 0xcec4b5c4
mov dword [ebp - 0x408], 0xb3fdd5c2
mov dword [ebp - 0x404], 0xccd8b7c7
mov dword [ebp - 0x400], 0xb1f0002e
mov dword [ebp - 0x3fc], 0xd0e3d3c5
mov dword [ebp - 0x3f8], 0xd2bbb5c4
xor eax, eax
mov dword [ebp - 0x3f4], 0xb2bbb0e3
push 0x3e
push eax
mov word [ebp - 0x3ec], ax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
mov dword [ebp - 0x3f0], 0xc2bccad5
call fcn.005c7c50
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005c3e89
add esp, 4
call fcn.005c3e68
cdq
mov ecx, 0xa
idiv ecx
xor edi, edi
lea eax, [edx + 3]
mov dword [ebp - 0x15b0], eax
test eax, eax
jle 0x472945
lea esi, [ebp - 0x4b4]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x472914
sub esi, ecx
sar esi, 1
call fcn.005c3e68
xor edx, edx
div esi
mov ax, word [ebp + edx*2 - 0x4b4]
mov word [ebp + edi*2 - 0x62c], ax
inc edi
cmp edi, dword [ebp - 0x15b0]
jl 0x472923
mov edi, dword [ebp - 0x15d0]
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x62c]
push eax
push edi
call fcn.005c51af
add esp, 8
mov dword [ebp - 0x15b0], eax
test eax, eax
je 0x4729e6
inc esi
cmp esi, 0x64
jl 0x472950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x15b0]
mov dword [ebp - 0x15d4], eax
cmp esi, 0xffffffff
je 0x4729b8
test eax, eax
je 0x4729e6
xor edx, edx
xor ecx, ecx
call fcn.00494320
push dword [ebp - 0x15d4]
mov edx, esi
mov ecx, 0x64bd30
call fcn.00485fd0
add esp, 4
mov ecx, dword [ebp - 0x15a8]
jmp 0x473500
test eax, eax
je 0x4729e6
xor edx, edx
xor ecx, ecx
call fcn.00494320
push dword [ebp - 0x15d4]
or edx, 0xffffffff
mov ecx, 0x64bd60
call fcn.00485fd0
mov ecx, dword [ebp - 0x15a8]
add esp, 4
jmp 0x473500
lea eax, [ebp - 0x62c]
push eax
push 0x6806a0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x1484]
push eax
call fcn.00463930
mov eax, dword [ebp - 0x15d8]
add eax, 0x51b
push eax
push 0x6806a0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x964]
push eax
call fcn.00463930
add esp, 0x20
lea edx, [ebp - 0x75c]
lea ecx, [ebp - 0x964]
call fcn.00494b40
mov ecx, dword [0x680408]
call fcn.004940f0
mov ecx, dword [0x6803fc]
mov esi, eax
call fcn.004940f0
test esi, esi
je 0x4729ad
test eax, eax
je 0x4729ad
cmp esi, eax
jne 0x4729ad
mov ecx, dword [0x680404]
call fcn.004940f0
mov ecx, dword [0x6803f8]
mov esi, eax
call fcn.004940f0
test esi, esi
je 0x4729ad
test eax, eax
je 0x4729ad
cmp esi, 2
jb 0x4729ad
cmp eax, 2
jb 0x4729ad
cmp esi, eax
jne 0x4729ad
mov ecx, dword [0x680400]
call fcn.004940f0
mov ecx, dword [0x6803f4]
mov esi, eax
call fcn.004940f0
cmp esi, eax
jne 0x4729ad
xor eax, eax
push 0x30
push eax
mov dword [ebp - 0x15b4], eax
mov dword [ebp - 0x15ac], eax
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x15d4], eax
lea eax, [ebp - 0x15a4]
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x15ec]
push eax
call fcn.005c1930
add esp, 0xc
test eax, eax
jne 0x472b44
lea eax, [ebp - 0x15a4]
push eax
lea eax, [ebp - 0x964]
push eax
call fcn.005c4d35
add esp, 8
test eax, eax
je 0x472b5f
push dword [ebp - 0x15ec]
call fcn.005c1e76
add esp, 4
lea eax, [ebp - 0x62c]
push edi
push eax
call fcn.005c51af
mov ecx, dword [ebp - 0x15a8]
add esp, 8
jmp 0x473500
mov esi, dword [ebp - 0x1590]
push esi
call fcn.0049a32d
add esp, 4
mov edi, eax
push dword [ebp - 0x15ec]
push 1
push esi
push edi
call fcn.005c469b
push dword [ebp - 0x15ec]
call fcn.005c1e76
add esp, 0x14
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x1544]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x44], xmm0
push eax
call fcn.0040c120
add esp, 4
lea eax, [ebp - 0x1544]
push esi
push edi
push eax
call fcn.0040bef0
add esp, 0xc
lea eax, [ebp - 0x1544]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040bfd0
push edi
call fcn.0049a336
add esp, 0xc
lea eax, [ebp - 0x14e4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x2c], xmm0
push eax
call fcn.0040beb0
add esp, 4
lea eax, [ebp - 0x44]
push 0x14
push eax
lea eax, [ebp - 0x14e4]
push eax
call fcn.0040bca0
add esp, 0xc
lea eax, [ebp - 0x14e4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040bd80
mov ecx, dword [ebp - 0x15e4]
add esp, 8
call fcn.004940f0
mov edi, eax
lea ecx, [ebp - 0x2c]
mov esi, 0xc
lea edx, [edi + 0x1c]
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x474191
add ecx, 4
add edx, 4
sub esi, 4
jae 0x472c30
mov edi, dword [ebp - 0x15a8]
mov ecx, edi
push 0x409
call fcn.004a99e6
mov ecx, eax
call fcn.004a9eb7
test eax, eax
je 0x472c8c
cmp dword [edi + 0x1b8], 0
mov eax, dword [edi + 0x1b4]
mov dword [ebp - 0x15cc], eax
je 0x472c96
test eax, eax
je 0x472c96
call fcn.00470ef0
cmp eax, 0x10
je 0x472c96
call fcn.00470f30
jmp 0x472c96
mov dword [ebp - 0x15cc], 0xffffffff
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x127c], ax
lea eax, [ebp - 0x127a]
push eax
call fcn.005c7c50
add esp, 0xc
mov dword [ebp - 0x188], 0x730025
xor eax, eax
mov dword [ebp - 0x184], 0x730025
mov word [ebp - 0x180], ax
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x188]
push 0x680928
push 0x64bbd4
push eax
lea eax, [ebp - 0x127c]
mov dword [ebp - 0x140], 0x74004f
push eax
mov dword [ebp - 0x13c], 0x650068
mov dword [ebp - 0x138], 0x72
mov dword [ebp - 0x264], 0x6f0043
mov dword [ebp - 0x260], 0x70006d
mov dword [ebp - 0x25c], 0x740061
mov dword [ebp - 0x258], 0x6e0045
mov dword [ebp - 0x254], 0x620061
mov dword [ebp - 0x250], 0x65006c
call fcn.00463930
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x127c]
add esp, 0x10
push eax
push 1
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x140]
push eax
call esi
cmp eax, 1
jl 0x472d7b
call fcn.004711b0
xor eax, eax
mov dword [ebp - 0x280], 0x70004f
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x127c]
push eax
push 2
lea eax, [ebp - 0x280]
mov dword [ebp - 0x27c], 0x690074
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x278], 0x69006d
push eax
mov dword [ebp - 0x274], 0x61007a
mov dword [ebp - 0x270], 0x690074
mov dword [ebp - 0x26c], 0x6e006f
call esi
cmp eax, 2
jl 0x472e42
lea eax, [ebp - 0x60]
mov dword [ebp - 0x30], 0x640064
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x610072
push eax
mov dword [ebp - 0x28], 0x2e0077
mov dword [ebp - 0x24], 0x6c0064
mov dword [ebp - 0x20], 0x6c
mov dword [ebp - 0x60], 0x640064
mov dword [ebp - 0x5c], 0x610072
mov dword [ebp - 0x58], 0x2e0077
mov dword [ebp - 0x54], 0x6c0064
mov dword [ebp - 0x50], 0x2e006c
mov dword [ebp - 0x4c], 0x610062
mov dword [ebp - 0x48], 0x6b
call fcn.005c51af
add esp, 8
call fcn.00470cc0
cmp eax, 1
jne 0x472e63
mov ecx, dword [ebp - 0x15d8]
lea edx, [ebp - 0x75c]
lea ecx, [ecx + 0x51b]
call fcn.00494b40
xor esi, esi
xor eax, eax
cmp esi, 0x32
jg 0x472ed4
cmp eax, 0x64
jg 0x472ed4
push 0
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x15c8]
push eax
lea eax, [ebp - 0x1644]
push eax
push 0
push 0
push 0x404
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1484]
push eax
call fcn.00404ba0
mov edi, eax
mov dword [ebp - 0x15b4], edi
test edi, edi
jne 0x472ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x15b0], eax
cmp eax, 2
mov eax, dword [ebp - 0x15ac]
jne 0x472ecb
inc esi
jmp 0x472e67
inc eax
mov dword [ebp - 0x15ac], eax
jmp 0x472e67
mov edx, dword [0x680dc8]
xor al, al
mov ecx, dword [0x680dc4]
mov esi, 1
mov edi, dword [ebp - 0x15a8]
sub edx, ecx
sar edx, 2
test edx, edx
movzx eax, al
mov dword [ebp - 0x1c], edx
cmove eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x15ac], eax
je 0x4730b2
xor edi, edi
lea eax, [ebp - 0x15f0]
push eax
push dword [ecx + edi*4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x47302b
cmp dword [ebp - 0x15f0], 0x103
jne 0x472fd2
mov eax, dword [0x680dc4]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
je 0x472fc3
movdqa xmm0, xmmword [0x64e5f0]
lea eax, [ebp - 0x118]
push 0xffffffffffffffff
push 0x649256
push 0x649256
push eax
push 0x35
lea eax, [ebp - 0x78]
mov byte [ebp - 0x15ac], 1
push 0x4d
push eax
mov dword [ebp - 0x78], 0x73736463
mov word [ebp - 0x74], 0x6473
mov byte [ebp - 0x72], 0
movdqu xmmword [ebp - 0x118], xmm0
mov dword [ebp - 0x108], 0x646e6570
mov byte [ebp - 0x104], 0
call fcn.00462b80
add esp, 0x1c
call fcn.0046bc20
mov eax, dword [0x680dc4]
push dword [eax + edi*4]
call esi
test eax, eax
jne 0x472fb0
jmp 0x47309b
mov eax, dword [0x680dc4]
push dword [eax + edi*4]
call esi
jmp 0x47309b
movdqa xmm0, xmmword [0x64e550]
lea eax, [ebp - 0x11c]
push 0xffffffffffffffff
push 0x649256
push 0x649256
push eax
mov dword [ebp - 0x38], 0x73736463
lea eax, [ebp - 0x38]
mov word [ebp - 0x34], 0x6473
mov byte [ebp - 0x32], 0
movdqu xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x10c], 0x726f2070
mov dword [ebp - 0x108], 0x6e614320
mov dword [ebp - 0x104], 0x6c6563
push 0x36
jmp 0x473084
movdqa xmm0, xmmword [0x64e5c0]
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push 0x649256
push 0x649256
movdqu xmmword [ebp - 0x170], xmm0
push eax
movdqa xmm0, xmmword [0x64e2f0]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x73736463
mov word [ebp - 0x20], 0x6473
mov byte [ebp - 0x1e], 0
movdqu xmmword [ebp - 0x160], xmm0
mov word [ebp - 0x150], 0x6574
mov byte [ebp - 0x14e], 0
push 0x37
push 0x4d
push eax
mov byte [ebp - 0x15ac], 1
call fcn.00462b80
add esp, 0x1c
call fcn.0046bc20
inc edi
cmp edi, dword [ebp - 0x1c]
jae 0x4730ac
mov ecx, dword [0x680dc4]
jmp 0x472f11
mov edi, dword [ebp - 0x15a8]
push 0x103
lea eax, [ebp - 0xe6b]
mov dword [ebp - 0xc0], 0x6e72656b
push 0
push eax
mov dword [ebp - 0xbc], 0x32336c65
mov dword [ebp - 0xb8], 0x6c6c642e
mov byte [ebp - 0xb4], 0
mov byte [ebp - 0xe6c], 0
call fcn.005c7c50
movdqa xmm0, xmmword [0x64e610]
lea eax, [ebp - 0x3e4]
add esp, 0xc
mov dword [ebp - 0x3d4], 0x4179726f
movdqu xmmword [ebp - 0x3e4], xmm0
mov byte [ebp - 0x3d0], 0
mov dword [ebp - 0x90], 0x6278795c
push eax
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x8c], 0x692e7173
push eax
mov word [ebp - 0x88], 0x696e
mov byte [ebp - 0x86], 0
call fcn.00401240
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4733f7
push 0x104
lea ecx, [ebp - 0xe6c]
push ecx
call eax
test eax, eax
je 0x4733f7
push 0x103
lea eax, [ebp - 0x4eb]
mov byte [ebp - 0x4ec], 0
push 0
push eax
call fcn.005c7c50
add esp, 0xc
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0x4ec]
push 0x104
push eax
call fcn.005c485c
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4ec]
push 0x104
push eax
call fcn.005c6231
add esp, 0xc
lea ecx, [ebp - 0x4ec]
call fcn.0045fb30
test al, al
je 0x4733f7
lea eax, [ebp - 0x4ec]
push eax
call fcn.005c51e2
add esp, 4
mov dword [ebp - 0x14d4], 0x780061
xor eax, eax
mov dword [ebp - 0x14d0], 0x760063
mov dword [ebp - 0x14cc], 0x32006a
mov dword [ebp - 0x14c8], 0x340033
push 0x600
mov dword [ebp - 0x14c4], 0x300038
mov dword [ebp - 0x14c0], 0x730039
mov dword [ebp - 0x14bc], 0x660064
mov dword [ebp - 0x14b8], 0x400040
mov dword [ebp - 0x14b4], 0x310040
mov dword [ebp - 0x14b0], 0x310032
mov dword [ebp - 0x14ac], 0x310033
mov dword [ebp - 0x14a8], 0x73006b
mov dword [ebp - 0x14a4], 0x6b0064
mov dword [ebp - 0x14a0], 0x78006c
mov dword [ebp - 0x149c], 0x760063
mov dword [ebp - 0x1498], 0x3b006b
mov dword [ebp - 0x1494], 0x73006c
mov dword [ebp - 0x1490], 0x660064
mov dword [ebp - 0x148c], 0x6b
mov dword [ebp - 0x152c], 0x7e0023
mov dword [ebp - 0x1528], 0x7e007e
mov dword [ebp - 0x1524], 0x58007e
mov dword [ebp - 0x1520], 0x670069
mov dword [ebp - 0x151c], 0x63006e
mov dword [ebp - 0x1518], 0x64006f
mov dword [ebp - 0x1514], 0x330065
mov dword [ebp - 0x1510], 0x7e007e
mov dword [ebp - 0x150c], 0x7e007e
mov dword [ebp - 0x1508], 0x41007e
mov dword [ebp - 0x1504], 0x65006c
mov dword [ebp - 0x1500], 0x740072
mov dword [ebp - 0x14fc], 0x7e007e
mov dword [ebp - 0x14f8], 0x7e007e
mov dword [ebp - 0x14f4], 0x7e007e
mov dword [ebp - 0x14f0], 0x23007e
mov word [ebp - 0x14ec], ax
call fcn.0049a300
mov esi, eax
add esp, 4
test esi, esi
je 0x4733a1
lea eax, [ebp - 0x14d4]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x152c]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
jmp 0x4733a7
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push 0x649256
push 0x649256
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0x73736463
push eax
push 0x39
lea eax, [ebp - 0x24]
mov word [ebp - 0x20], 0x6473
push 0x4d
push eax
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x3c], 0x65657073
mov dword [ebp - 0x38], 0x61682064
mov word [ebp - 0x34], 0x6b63
mov byte [ebp - 0x32], 0
call fcn.00462b80
add esp, 0x1c
call fcn.0046bc20
jmp 0x473400
cmp byte [ebp - 0x15ac], 1
jne 0x473471
push dword [ebp - 0x15d0]
lea eax, [ebp - 0x62c]
push eax
call fcn.005c51af
add esp, 8
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15b4]
test eax, eax
je 0x4734fe
mov eax, dword [ebp - 0x15c8]
test eax, eax
je 0x473451
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x4734fe
push eax
call esi
mov dword [ebp - 0x15c4], 0
jmp 0x4734fe
mov eax, dword [ebp - 0x15b4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47401a
xor esi, esi
jmp 0x473490
push dword [ebp - 0x15d0]
lea eax, [ebp - 0x62c]
push eax
call fcn.005c51af
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x47353f
inc esi
cmp esi, 0x64
jl 0x473490
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x15ac], eax
cmp esi, 0xffffffff
je 0x473528
test eax, eax
je 0x47353f
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x15ac]
mov edx, esi
mov ecx, 0x64bd90
call fcn.00485fd0
add esp, 4
mov ecx, edi
call fcn.0047be60
lea esp, [ebp - 0x1654]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret 4
test eax, eax
je 0x47353f
cmp eax, 0x20
jne 0x473771
mov dword [ebp - 0x15d4], 1
lea ecx, [ebp - 0x15b4]
call fcn.00460db0
lea eax, [ebp - 0x14e4]
mov dword [ebp - 4], 0
push eax
call fcn.0040c120
mov ecx, dword [0x6803bc]
add esp, 4
push 0
call fcn.004940f0
mov edx, 7
mov ecx, eax
call fcn.00492f70
mov ecx, dword [0x6803bc]
add esp, 4
push 0x10
call fcn.004940f0
add eax, 8
push eax
lea eax, [ebp - 0x14e4]
push eax
call fcn.0040bef0
mov ecx, dword [0x6803bc]
add esp, 0xc
call fcn.004940f0
mov edx, 0x10
lea ecx, [eax + 8]
call fcn.00494090
mov ecx, dword [0x6803bc]
push 0x10
call fcn.004940f0
add eax, 8
push eax
lea eax, [ebp - 0x14e4]
push eax
call fcn.0040bef0
mov ecx, dword [0x6803bc]
add esp, 0xc
call fcn.004940f0
mov edx, 0x10
lea ecx, [eax + 8]
call fcn.00494090
mov ecx, dword [0x6803bc]
push 0
call fcn.004940f0
mov edx, 7
mov ecx, eax
call fcn.00492fc0
add esp, 4
lea eax, [ebp - 0x14e4]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040bfd0
add esp, 8
mov dword [ebp - 0x28], 0x300025
xor eax, eax
mov dword [ebp - 0x24], 0x580032
lea ecx, [ebp - 0x15b4]
mov word [ebp - 0x20], ax
mov dword [ebp - 0x3c], 0x300025
push 0x64b984
mov dword [ebp - 0x38], 0x580038
mov word [ebp - 0x34], ax
call fcn.00464130
lea ecx, [ebp - 0x114]
xor esi, esi
dec ecx
mov dword [ebp - 0x15f0], ecx
lea eax, [esi + 1]
mov dword [ebp - 0x15ac], eax
add eax, ecx
mov dword [ebp - 0x1c], eax
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x15b4]
push eax
call fcn.00460980
add esp, 0xc
cmp esi, 0x14
jae 0x474015
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov eax, dword [ebp - 0x15ac]
and eax, reloc.WS2_32.dll_closesocket
jns 0x4736a9
dec eax
or eax, 0xfffffffc
inc eax
jne 0x4736c0
cmp esi, 0x13
jge 0x4736c0
push 0x64bdf0
lea ecx, [ebp - 0x15b4]
call fcn.00464130
mov eax, dword [ebp - 0x15ac]
mov ecx, 0xc
cdq
idiv ecx
test edx, edx
jne 0x473706
cmp esi, 0x13
jge 0x473706
mov eax, dword [ebp - 0x15c0]
xor eax, 0x5b429d65
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x15b4]
push eax
call fcn.00460980
add esp, 0xc
lea ecx, [ebp - 0x15b4]
push 0x64bdf0
call fcn.00464130
mov esi, dword [ebp - 0x15ac]
mov ecx, dword [ebp - 0x15f0]
cmp esi, 0x14
jl 0x473663
push 0x64b994
lea ecx, [ebp - 0x15b4]
call fcn.00464130
mov ecx, dword [ebp - 0x15b4]
cmp dword [ecx - 4], 1
jle 0x47374b
push dword [ecx - 0xc]
lea ecx, [ebp - 0x15b4]
call fcn.00460a00
mov ecx, dword [ebp - 0x15b4]
push ecx
call fcn.00494240
add esp, 4
test eax, eax
je 0x473d49
mov esi, dword [0x680c6c]
test esi, esi
jne 0x4737b5
mov eax, dword [0x680c70]
test eax, eax
jne 0x47379b
jmp 0x4737b5
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x15ac]
or edx, 0xffffffff
mov ecx, 0x64bdc0
jmp 0x4734f6
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [0x680c6c], esi
mov ecx, dword [ebp - 0x15e4]
mov dword [esi + 0x4002a4], 0x134da7e
call fcn.004940f0
push 0x4c
mov ecx, esi
mov dword [ebp - 0x15ac], eax
mov edx, dword [eax + 0xb8]
call fcn.0048ffc0
add esp, 4
cmp byte [0x6803ac], 1
jne 0x4737f7
push 1
xor edx, edx
call fcn.0048ffc0
add esp, 4
mov eax, dword [ebp - 0x15cc]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0xffffffff
mov eax, dword [ebp - 0x15bc]
push 0x680928
mov dword [esi + 0x54], eax
lea eax, [esi + 0x58]
push 0x20
push eax
call fcn.005c1442
mov eax, dword [0x680670]
add esp, 0xc
test eax, eax
je 0x473846
push eax
lea ecx, [esi + 0x9c]
mov dword [esi + 0x98], eax
mov edx, 0x680470
call fcn.0048ffc0
add esp, 4
mov eax, dword [0x68046c]
test eax, eax
je 0x47386a
mov edx, dword [0x680468]
lea ecx, [esi + 0x2a0]
push eax
mov dword [esi + 0x29c], eax
call fcn.0048ffc0
add esp, 4
mov ecx, dword [ebp - 0x15ac]
push 0x80
mov eax, dword [ecx + 0x2c]
lea edx, [ecx + 0x30]
lea ecx, [esi + 0x4002ac]
mov dword [esi + 0x4002a8], eax
call fcn.0048ffc0
mov edx, dword [ebp - 0x15ac]
lea ecx, [esi + 0x40032c]
add esp, 4
mov edx, dword [edx + 0xb4]
push 0x1d9
call fcn.0048ffc0
mov ecx, dword [0x680464]
add esp, 4
push 0x14
call fcn.004940f0
lea ecx, [esi + 0x400505]
mov edx, eax
call fcn.0048ffc0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x15d8]
mov dword [esi + 0x400519], eax
push 0x100
mov al, byte [ecx + 0xa1f]
lea edx, [ecx + 0xa20]
lea ecx, [esi + 0x40051e]
mov byte [esi + 0x40051d], al
call fcn.0048ffc0
mov ecx, dword [ebp - 0x15d8]
add esp, 4
mov al, byte [ecx + 0xb20]
lea edx, [ecx + 0xb21]
push 0x100
lea ecx, [esi + 0x40061f]
mov byte [esi + 0x40061e], al
call fcn.0048ffc0
mov eax, dword [ebp - 0x15ac]
add esp, 4
mov dword [esi + 0x4002a0], 0
cmp dword [eax + 8], 4
jne 0x473a16
xor eax, eax
mov dword [ebp - 0x16c], 0x690057
lea ecx, [ebp - 0x15ac]
mov dword [ebp - 0x168], 0x44006e
mov dword [ebp - 0x164], 0x73006f
mov dword [ebp - 0x160], 0x640047
mov dword [ebp - 0x15c], 0x5f0069
mov dword [ebp - 0x158], 0x300025
mov dword [ebp - 0x154], 0x580038
mov word [ebp - 0x150], ax
call fcn.00460db0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x15c0]
xor eax, 0x2b429d65
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x15ac]
push eax
call fcn.00460980
mov eax, dword [ebp - 0x15ac]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x4739e7
push dword [eax - 0xc]
lea ecx, [ebp - 0x15ac]
call fcn.00460a00
mov eax, dword [ebp - 0x15ac]
push eax
push 0x80
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea ecx, [ebp - 0x15ac]
mov dword [0x680448], eax
call fcn.004609a0
lea ecx, [ebp - 0x15ac]
call fcn.0045fec0
push dword [ebp - 0x15c4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [0x6803ac], 0
je 0x473a4a
push 1
xor edx, edx
mov ecx, esi
call fcn.0048ffc0
add esp, 4
mov dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x4002a4], 0x42e576f7
cmp dword [esi + 0x50], 0xffffffff
jne 0x473a78
xor edi, edi
cmp dword [esi + 0x4002a0], 0
jne 0x473a72
cmp edi, 0xbb8
jge 0x473a72
push 1
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x50], 0xffffffff
je 0x473a52
mov edi, dword [ebp - 0x15a8]
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x4ac], ax
lea eax, [ebp - 0x4aa]
push eax
call fcn.005c7c50
add esp, 0xc
mov byte [ebp - 0xd64], 0
lea eax, [ebp - 0xd63]
push 0x3ff
push 0
push eax
call fcn.005c7c50
movdqa xmm0, xmmword [0x64e1f0]
xor eax, eax
movdqu xmmword [ebp - 0x1518], xmm0
add esp, 0xc
mov dword [ebp - 0x7c], 0x4c6e6957
movdqa xmm0, xmmword [0x64e4a0]
movdqu xmmword [ebp - 0x1508], xmm0
mov dword [ebp - 0x78], 0x6e656369
movdqa xmm0, xmmword [0x64e430]
mov word [ebp - 0x74], 0x6573
mov byte [ebp - 0x72], 0
mov dword [ebp - 0x5c], 0x690057
mov dword [ebp - 0x58], 0x4c006e
mov dword [ebp - 0x54], 0x630069
mov dword [ebp - 0x50], 0x6e0065
mov dword [ebp - 0x4c], 0x650073
mov word [ebp - 0x48], ax
movdqu xmmword [ebp - 0x14f8], xmm0
mov dword [ebp - 0x14e8], 0x2e6e6f
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x15cc], eax
cmp eax, 0x4d236ad
ja 0x473bdb
je 0x473b54
dec eax
cmp eax, 1
ja 0x473be4
mov eax, dword [ebp - 0x15cc]
cmp dword [esi + 0x4002a0], 0x134da7e
mov byte [ebp - 0x15b5], 1
je 0x473da7
cmp eax, 0x4d236ad
jne 0x473da7
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push dword [ebp - 0x15c8]
mov byte [ebp - 0x15b5], 0
call eax
mov eax, dword [ebp - 0x15c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473ba9
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x473bc0
push eax
call esi
mov dword [ebp - 0x15c4], 0
lea eax, [ebp - 0x1518]
push eax
lea eax, [ebp - 0xd64]
push eax
call fcn.0048d0d0
add esp, 8
jmp 0x473d2b
cmp eax, 0xffffffff
je 0x473c5f
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push dword [ebp - 0x15c8]
call eax
mov eax, dword [ebp - 0x15c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473c10
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x473c27
push eax
call esi
mov dword [ebp - 0x15c4], 0
push dword [ebp - 0x15cc]
lea eax, [ebp - 0x4ac]
push str.File_corrupted_._This_application_has_been_manipulated_and_maybe_r_nits_infected_by_a_Virus_or_cracked._This_application_wont_work_anymore._r_nError:_08X
push eax
call fcn.0048d0f0
add esp, 0xc
lea eax, [ebp - 0x5c]
push 0x10
push eax
lea eax, [ebp - 0x4ac]
push eax
push dword [0x680c00]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x473da7
cmp word [ebp - 0x964], 0
je 0x473da7
cmp word [ebp - 0x962], 0
je 0x473da7
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push dword [ebp - 0x15c8]
call eax
mov eax, dword [ebp - 0x15c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473ca7
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x473cbe
push eax
call esi
mov dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x15d8]
add eax, 0x51b
je 0x473d0f
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473cd0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x473cee
xor eax, eax
jmp 0x473d0f
add esi, esi
mov eax, esi
call fcn.005c9300
mov ecx, dword [ebp - 0x15d8]
mov eax, esp
push 3
push esi
add ecx, 0x51b
push ecx
push eax
call fcn.0048f9c0
lea ecx, [ebp - 0x75c]
push ecx
push eax
lea eax, [ebp - 0xd64]
push str.Cannot_find__s._Please__re_install_this_application._r_nMissing_file_path:_s
push eax
call fcn.0048d0d0
add esp, 0x10
push 0x10
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xd64]
push eax
push dword [0x680c00]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x473da7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push dword [ebp - 0x15c8]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
push esi
mov edx, 2
mov ecx, 0x64bf78
call fcn.00485fd0
mov eax, dword [ebp - 0x15c8]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473d90
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x473da7
push eax
call esi
mov dword [ebp - 0x15c4], 0
call fcn.00494280
lea ecx, [ebp - 0x15b4]
call fcn.004609a0
lea ecx, [ebp - 0x15b4]
mov dword [ebp - 4], 0xffffffff
call fcn.0045fec0
cmp byte [ebp - 0x15b5], 0
je 0x47400a
lea eax, [ebp - 0x15dc]
mov dword [ebp - 0x5c], 0x69006c
push eax
push 0x46b810
push dword [ebp - 0x15bc]
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0x65006e
mov dword [ebp - 0x54], 0x670061
xor esi, esi
mov dword [ebp - 0x50], 0x2e0065
mov dword [ebp - 0x4c], 0x660063
mov dword [ebp - 0x48], 0x67
movq qword [ebp - 0x15dc], xmm0
call dword [sym.imp.USER32.dll_EnumThreadWindows]
test eax, eax
je 0x473e5d
lea esp, [esp]
cmp esi, 0x1388
jge 0x473e5d
push 1
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x15dc]
push eax
push 0x46b810
push dword [ebp - 0x15bc]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
test eax, eax
jne 0x473e30
mov eax, dword [ebp - 0x15dc]
test eax, eax
je 0x473f6a
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [ebp - 0x15bc]
je 0x47400a
cmp dword [ebp - 0x15d8], 1
je 0x47400a
lea eax, [ebp - 0x15cc]
mov dword [ebp - 0x15cc], 0
push eax
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x473f11
push eax
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0xc
mov ecx, 0x64bfec
call fcn.00485fd0
mov eax, dword [ebp - 0x15c8]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473ef1
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x4740b6
push eax
call esi
mov dword [ebp - 0x15c4], 0
jmp 0x4740b6
cmp dword [ebp - 0x15cc], 0x103
jne 0x473f49
mov eax, dword [edi + 0x2dc]
cmp eax, 3
jl 0x473f79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 2
mov ecx, 0x64bf78
call fcn.00485fd0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4740b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0xd
mov ecx, 0x64c008
call fcn.00485fd0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4740b3
mov eax, dword [edi + 0x2dc]
cmp eax, 3
jge 0x473fe9
push 0
push dword [ebp - 0x15c8]
inc eax
mov dword [edi + 0x2dc], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x15c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x473fab
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x473fc2
push eax
call esi
mov dword [ebp - 0x15c4], 0
cmp dword [edi + 0x2dc], 2
jne 0x473fd7
lea eax, [ebp - 0x5c]
push eax
call fcn.005c5224
add esp, 4
push dword [ebp - 0x15e4]
mov ecx, edi
call fcn.004711f0
jmp 0x4740b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0xb
mov ecx, 0x64c028
call fcn.00485fd0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4740b3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4740b6
call fcn.005c0c80
mov dword [ebp - 0x15cc], 0
jmp 0x474030
push dword [ebp - 0x15d0]
lea eax, [ebp - 0x62c]
push eax
call fcn.005c51af
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x47409d
mov eax, dword [ebp - 0x15cc]
inc eax
mov dword [ebp - 0x15cc], eax
cmp eax, 0x64
jl 0x474030
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
je 0x474077
test eax, eax
je 0x47409d
mov ecx, 0x64bf8c
jmp 0x474094
test eax, eax
je 0x47409d
cmp eax, 0x20
jne 0x47408c
mov dword [ebp - 0x15d4], 1
jmp 0x47409d
or edx, 0xffffffff
mov ecx, 0x64bfbc
push eax
call fcn.00485fd0
add esp, 4
mov eax, dword [ebp - 0x15b0]
mov edx, 1
push eax
mov ecx, 0x64bf78
call fcn.00485fd0
add esp, 4
cmp dword [ebp - 0x15d4], 0
je 0x474139
mov dword [ebp - 0x15b0], 0
lea ecx, [ecx]
push dword [ebp - 0x15d0]
lea eax, [ebp - 0x62c]
push eax
call fcn.005c51af
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x474139
mov eax, dword [ebp - 0x15b0]
inc eax
mov dword [ebp - 0x15b0], eax
cmp eax, 0x64
jl 0x4740d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
je 0x474117
test eax, eax
je 0x474139
mov ecx, 0x64c040
jmp 0x474130
test eax, eax
je 0x474139
or edx, 0xffffffff
cmp eax, 0x20
jne 0x47412b
push eax
mov ecx, 0x64c070
jmp 0x474131
mov ecx, 0x64c0a0
push eax
call fcn.00485fd0
add esp, 4
cmp byte [0x6803ac], 0
je 0x474155
push 0
push dword [ebp - 0x15c8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x47343a
mov eax, dword [ebp - 0x15c8]
test eax, eax
je 0x47416c
push eax
call esi
mov dword [ebp - 0x15c8], 0
mov eax, dword [ebp - 0x15c4]
test eax, eax
je 0x474183
push eax
call esi
mov dword [ebp - 0x15c4], 0
xor edx, edx
xor ecx, ecx
call fcn.00494320
jmp 0x4734fe
xor eax, eax
mov dword [ebp - 0x964], eax
push dword [edi + 0xb4]
call fcn.0049a336
add esp, 4
push dword [edi + 0xb8]
call fcn.0049a336
add esp, 4
push edi
call fcn.0049a336
add esp, 4
lea eax, [ebp - 0x62c]
push dword [ebp - 0x15d0]
push eax
call fcn.005c51af
mov ecx, dword [ebp - 0x15a8]
add esp, 8
jmp 0x473500
xor edx, edx
xor ecx, ecx
call fcn.00494320
push 0x600
call fcn.0049a300
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
add esp, 4
test esi, esi
je 0x47423a
lea eax, [ebp - 0x1e8]
push eax
push esi
call fcn.0045e930
lea eax, [ebp - 0x14c]
push eax
lea eax, [esi + 0x400]
push eax
call fcn.0045e950
add esp, 0x10
push 0
push 0
push esi
push 0x45ad30
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffa
push 0x649256
push 0x649256
push 0x649256
push 0x3d
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x73736463
push 0x4d
push eax
mov word [ebp - 0x20], 0x6473
mov byte [ebp - 0x1e], 0
call fcn.00462b80
add esp, 0x1c
jmp 0x4713e9
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47429e
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x474292
mov ecx, esi
call fcn.004a4523
mov ecx, esi
call fcn.004ad760
jmp 0x473505
mov ecx, esi
call fcn.0047b910
jmp 0x4725da