Function at 0x649b40
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26e
push 0
push 0
dec ecx
jne 0x649b48
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x6499a4]
call fcn.0040c734
lea eax, [ebp - 0x52]
mov edx, dword [0x61994c]
call fcn.0040c734
xor eax, eax
push ebp
push 0x64ce6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x679df7], 1
mov byte [0x679df6], 0
mov byte [0x679df5], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x400]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f0]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f4]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x404]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x408]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x40c]
call fcn.00550b80
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x410]
call fcn.00550b80
push 0x64ce88
lea eax, [ebp - 0x10bc]
push eax
mov ecx, 0x64ceb0
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10bc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
push 0x64cee0
lea eax, [ebp - 0x10c4]
push eax
mov ecx, 0x64cf0c
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10c4]
lea edx, [ebp - 0x10c0]
call fcn.00639a94
mov edx, dword [ebp - 0x10c0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f8]
call fcn.005505d4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
xor edx, edx
call fcn.0058d28c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00550b88
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
lea edx, [ebp - 0x10cc]
mov eax, dword [0x679e3c]
call fcn.00427324
mov eax, dword [ebp - 0x10cc]
lea edx, [ebp - 0x10c8]
call fcn.00431154
mov edx, dword [ebp - 0x10c8]
mov eax, 0x679e3c
call fcn.0040b814
push 0
lea eax, [ebp - 0x10d8]
push eax
mov ecx, 0x64cf1c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10d8]
lea edx, [ebp - 0x10d4]
call fcn.00637ab4
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00639a94
mov edx, dword [ebp - 0x10d0]
mov eax, 0x679e14
call fcn.0040b814
mov dl, 1
mov eax, dword [0x487b54]
call fcn.004b3ab4
mov dword [0x679e64], eax
xor eax, eax
mov dword [0x679e6c], eax
xor eax, eax
mov dword [0x679e70], eax
xor eax, eax
mov dword [0x679e74], eax
xor eax, eax
mov dword [0x679e78], eax
cmp byte [0x679e55], 0
je 0x649e70
push dword [0x679e3c]
push 0x64cf50
lea ecx, [ebp - 0x10dc]
mov edx, 0x64cf60
mov eax, dword [0x679e2c]
call fcn.00428f8c
push dword [ebp - 0x10dc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c270
lea edx, [ebp - 0x10e0]
mov eax, dword [ebp - 8]
call fcn.00636a10
mov eax, dword [ebp - 0x10e0]
mov dl, 1
call fcn.004287ec
test al, al
je 0x649e70
push 0
lea eax, [ebp - 0x10e4]
mov ecx, 0x64cf78
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x10e4]
call fcn.0040bf9c
push eax
lea edx, [ebp - 0x10e8]
mov eax, dword [ebp - 8]
call fcn.00636a10
mov eax, dword [ebp - 0x10e8]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x649e70
lea eax, [ebp - 0x10ec]
mov ecx, 0x64cf78
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov ecx, dword [ebp - 0x10ec]
mov dl, 1
mov eax, dword [0x50e494]
call fcn.00511fa4
mov dword [0x679de8], eax
mov ecx, dword [0x679e64]
mov edx, 0x64cfa4
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x679e64]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x679e74], eax
mov ecx, dword [0x679e64]
mov edx, 0x64cfbc
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x679e64]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x679e78], eax
mov eax, dword [0x679de8]
call fcn.00409670
call fcn.00437860
push eax
lea eax, [ebp - 0x10f0]
mov ecx, 0x64cf78
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov ecx, dword [ebp - 0x10f0]
mov dl, 1
mov eax, dword [0x50e494]
call fcn.00511fe8
mov dword [0x679de8], eax
push 0
mov ecx, 0x64cfe8
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x649edb
push 0
mov ecx, 0x64d00c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
cmp al, 1
je 0x64a120
lea edx, [ebp - 0x10f4]
mov al, 0x1c
call fcn.00637c8c
mov eax, dword [ebp - 0x10f4]
push eax
mov ecx, 0x64d034
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x10f8]
mov al, 0x1d
call fcn.00637c8c
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, 0x64d06c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1100]
push eax
mov ecx, 0x64d090
mov edx, 0x64d0a0
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1100]
lea edx, [ebp - 0x10fc]
call fcn.00639a94
mov eax, dword [ebp - 0x10fc]
push eax
mov ecx, 0x64d090
mov edx, 0x64d0c0
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b424
push 0
mov ecx, 0x64d0e0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x649fbd
push 0
mov ecx, 0x64d0fc
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x649fbd
lea eax, [ebp - 8]
mov edx, 0x64d114
call fcn.0040b85c
push 0
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x64cf0c
mov edx, 0x64d0a0
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x110c]
lea edx, [ebp - 0x1108]
call fcn.00639a94
mov ecx, dword [ebp - 0x1108]
lea eax, [ebp - 0x1104]
mov edx, dword [ebp - 8]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1104]
push eax
mov ecx, 0x64cf0c
mov edx, 0x64d0c0
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x1114]
push eax
lea edx, [ebp - 0x1118]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1118]
mov edx, 0x64d0a0
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00639a94
mov eax, dword [ebp - 0x1110]
push eax
lea edx, [ebp - 0x111c]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x111c]
mov edx, 0x64d0c0
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x64a021
push 0
mov ecx, 0x64d1d0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a120
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x1124]
push eax
lea edx, [ebp - 0x1128]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1128]
mov edx, 0x64d1d0
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00639a94
mov eax, dword [ebp - 0x1120]
push eax
lea edx, [ebp - 0x112c]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x112c]
mov edx, 0x64d1d0
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x1e
jne 0x64a0b0
lea edx, [ebp - 0x1130]
mov al, 0x37
call fcn.00637c8c
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x64d1ec
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x679df3]
xor al, 1
push eax
mov ecx, 0x64d204
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x679df3]
push eax
mov ecx, 0x64d228
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x679df0]
push eax
mov ecx, 0x64d248
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x679dec]
push eax
mov ecx, 0x64d260
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [0x679e3c]
push eax
mov ecx, 0x64d274
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x64d298
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64a200
mov ecx, 0x64d298
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x679e14], 0
je 0x64a223
mov eax, dword [0x679e14]
push eax
mov ecx, 0x64cf1c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x679e40]
push eax
mov ecx, 0x64d2c4
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x679ded], 0
je 0x64a677
cmp byte [0x679dee], 0
je 0x64a279
mov eax, 0x64d2f0
call fcn.006368fc
test al, al
je 0x64a279
push 1
mov ecx, 0x64d318
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a2a4
push 0
mov ecx, 0x64d33c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d318
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d368
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d368
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d390
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d390
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d3c0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a35f
push 0
lea eax, [ebp - 0x1138]
push eax
mov ecx, 0x64d3f0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1138]
lea edx, [ebp - 0x1134]
call fcn.00639a94
mov eax, dword [ebp - 0x1134]
push eax
mov ecx, 0x64d3f0
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x64a375
push 0
mov ecx, 0x64d3f0
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64d430
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a3da
push 0
lea eax, [ebp - 0x1140]
push eax
mov ecx, 0x64d464
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1140]
lea edx, [ebp - 0x113c]
call fcn.00639a94
mov eax, dword [ebp - 0x113c]
push eax
mov ecx, 0x64d464
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x64a3f0
push 0
mov ecx, 0x64d464
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64d48c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d48c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d4b4
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a4f8
push 0
lea eax, [ebp - 0x1148]
push eax
mov ecx, 0x64d4e4
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1148]
lea edx, [ebp - 0x1144]
call fcn.00639a94
mov eax, dword [ebp - 0x1144]
push eax
mov ecx, 0x64d51c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1150]
push eax
mov ecx, 0x64d53c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00639a94
mov eax, dword [ebp - 0x114c]
push eax
mov ecx, 0x64d574
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64d59c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d5d8
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a524
mov ecx, 0x64d51c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64a524
mov ecx, 0x64d51c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64d600
call fcn.006368fc
push eax
mov ecx, 0x64d62c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64d654
call fcn.006368fc
push eax
mov ecx, 0x64d684
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64d6b4
call fcn.006368fc
push eax
mov ecx, 0x64d6e8
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64d718
call fcn.006368fc
test al, al
je 0x64a5a7
push 1
mov ecx, 0x64d748
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a5d3
mov ecx, 0x64d748
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64a5d3
mov ecx, 0x64d748
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64d778
call fcn.006368fc
test al, al
je 0x64a5f9
push 1
mov ecx, 0x64d7ac
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a625
mov ecx, 0x64d7ac
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64a625
mov ecx, 0x64d7ac
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64d7e0
call fcn.006368fc
test al, al
je 0x64a64b
push 1
mov ecx, 0x64d81c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a677
mov ecx, 0x64d81c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64a677
mov ecx, 0x64d81c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
push 0
mov ecx, 0x64d1d0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a9a3
push 0
lea eax, [ebp - 0x1158]
push eax
mov ecx, 0x64d854
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1158]
lea edx, [ebp - 0x1154]
call fcn.00639a94
mov eax, dword [ebp - 0x1154]
push eax
mov ecx, 0x64d854
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64d874
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a9a3
push 1
mov ecx, 0x64d874
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d89c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d89c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d8cc
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d8cc
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d900
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d900
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d930
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d930
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d930
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a835
push 0xffffffffffffffff
mov ecx, 0x64d95c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x64d95c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x64d988
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a84b
push 1
mov ecx, 0x64d988
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64a84b
push 0
mov ecx, 0x64d95c
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x64d9b8
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a87b
push 1
mov ecx, 0x64d9b8
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d9ec
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64d9ec
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64d9ec
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a8eb
push 0
mov ecx, 0x64da28
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x64da28
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x1160]
push eax
mov ecx, 0x64da58
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1160]
lea edx, [ebp - 0x115c]
call fcn.00639a94
mov eax, dword [ebp - 0x115c]
push eax
mov ecx, 0x64da58
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1164]
push eax
mov ecx, 0x64da88
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x1164], 0
je 0x64a9a3
push 0
lea eax, [ebp - 0x116c]
push eax
mov ecx, 0x64da88
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x116c]
lea edx, [ebp - 0x1168]
call fcn.00639a94
mov eax, dword [ebp - 0x1168]
push eax
mov ecx, 0x64da88
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [0x679e5a], 0
push 0
mov ecx, 0x64dab8
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64a9db
mov dl, 1
mov eax, dword [0x679e3c]
call fcn.00428884
test al, al
je 0x64a9db
mov byte [0x679e5a], 1
cmp byte [0x679dec], 0
je 0x64aa4c
xor eax, eax
push ebp
push 0x64aa42
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x679e84], eax
push 0x64dad8
push 0x64db18
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041717c
mov dword [0x679e7c], eax
push 0x64db34
push 0x64db18
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041717c
mov dword [0x679e80], eax
push 0x679e84
call dword [0x679e7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64aa4c
push 0x1f4
call sub.kernel32.dll_Sleep
push 0x64db7c
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x64dbb0
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1170]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
xor eax, eax
push ebp
push 0x64ab19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x1174]
xor eax, eax
call fcn.0040741c
mov ecx, dword [ebp - 0x1174]
mov dl, 1
mov eax, dword [0x48ae0c]
call fcn.004b5d88
mov dword [0x679da8], eax
mov eax, dword [0x679dd8]
xor edx, edx
push edx
push eax
mov eax, dword [0x679da8]
call fcn.004b3ce8
push 0xff00
lea eax, [ebp - 0x1178]
mov ecx, 0x64dbc4
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov ecx, dword [ebp - 0x1178]
mov dl, 1
mov eax, dword [0x48ae0c]
call fcn.004b5d88
mov dword [0x679dac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ab77
xor esi, esi
mov eax, dword [0x679ddc]
sub eax, esi
cmp eax, 0x1000
jb 0x64aba0
lea edx, [ebp - 0x10b8]
mov ecx, 0x1000
mov eax, dword [0x679da8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x64abba
mov ecx, dword [0x679ddc]
sub ecx, esi
lea edx, [ebp - 0x10b8]
mov eax, dword [0x679da8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10b8]
mov ecx, ebx
mov eax, dword [0x679dac]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x679ddc]
mov dword [ebp - 0x1180], eax
xor eax, eax
mov dword [ebp - 0x117c], eax
fild qword [ebp - 0x1180]
fdivr dword [0x64dbe4]
mov dword [ebp - 0x1180], esi
xor eax, eax
mov dword [ebp - 0x117c], eax
fild qword [ebp - 0x1180]
fmulp st(1)
call fcn.00407aa0
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058d28c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00550bc8
cmp ebx, 0x1000
je 0x64ab79
mov eax, dword [0x679dac]
call fcn.00409670
mov eax, dword [0x679da8]
call fcn.00409670
push 0x64dbf4
lea eax, [ebp - 0x1184]
push eax
mov ecx, 0x64dc24
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1184]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
mov dl, 1
mov eax, dword [0x619c9c]
call fcn.0062024c
mov dword [0x679db0], eax
xor eax, eax
push ebp
push 0x64acd7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1188]
mov ecx, 0x64dbc4
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov edx, dword [ebp - 0x1188]
mov cl, 1
mov eax, dword [0x679db0]
call fcn.006202cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ad35
mov dl, 1
mov eax, dword [0x487b54]
call fcn.004b3ab4
mov dword [ebp - 4], eax
mov byte [ebp - 0x76], 0
mov eax, 0x64dc34
call fcn.006368fc
xor al, 1
mov byte [ebp - 0x75], al
mov eax, 0x64dc5c
call fcn.006368fc
mov byte [0x679df4], al
push 0
mov ecx, 0x64dc84
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov byte [0x679df9], 0
mov byte [0x679dfa], 0
lea eax, [ebp - 0x10]
call fcn.0040b424
push 0
mov ecx, 0x64dca8
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x679dfc], eax
push 0
mov ecx, 0x64dccc
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x679e00], eax
mov eax, dword [0x6724d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x424]
cmp byte [eax + 0x69], 0
je 0x64aef9
mov eax, dword [0x6724d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64aef9
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
mov eax, dword [0x6724d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov edx, dword [ebp - 0x60]
call fcn.00631ac4
test al, al
jne 0x64aeea
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.006497f0
cmp dword [ebp - 8], 0
je 0x64aeea
lea edx, [ebp - 0x118c]
mov eax, dword [ebp - 8]
call fcn.00426f1c
mov edx, dword [ebp - 0x118c]
lea eax, [ebp - 8]
call fcn.0040b85c
mov eax, dword [ebp - 8]
mov edx, 0x64dcf0
call fcn.0040c320
jne 0x64ae7c
mov byte [0x679df9], 1
jmp 0x64aeea
mov eax, dword [ebp - 8]
mov edx, 0x64dd14
call fcn.0040c320
jne 0x64ae94
mov byte [0x679dfa], 1
jmp 0x64aeea
mov eax, dword [ebp - 8]
mov edx, 0x64dd38
call fcn.0040c320
jne 0x64aeb3
mov byte [0x679df9], 1
mov byte [0x679dfa], 1
jmp 0x64aeea
mov eax, dword [ebp - 8]
mov edx, 0x64dd58
call fcn.0040c320
jne 0x64aed2
mov byte [0x679df9], 1
mov byte [0x679dfa], 1
jmp 0x64aeea
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x64dd7c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c270
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64ae11
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x73]
mov eax, 0x64dd8c
call fcn.006368fc
xor al, 1
mov byte [0x679e5c], al
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x64bd7a
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
cmp byte [0x679df6], 0
je 0x64af3c
push ebp
call fcn.00649a04
pop ecx
cmp byte [0x679df9], 0
je 0x64af54
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x679dfc]
jl 0x64bd6b
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1190]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1190]
mov edx, 0x64cfa4
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x64af87
mov al, 1
jmp 0x64afa9
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ddc0
call fcn.0040c4b4
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
sete al
test al, al
jne 0x64bd6b
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ddc0
call fcn.0040c4b4
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x90]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c358
cmp byte [0x679dfa], 0
je 0x64b008
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x679dfc]
jl 0x64b008
mov eax, dword [ebp - 0x1c]
mov edx, 0x64ddd0
call fcn.0040c320
jne 0x64bd6b
cmp byte [ebp - 0x73], 0
je 0x64b0e9
mov byte [ebp - 0x74], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b85c
jmp 0x64b0c3
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64dd7c
call fcn.0040c4b4
mov esi, eax
lea eax, [ebp - 0x1194]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c358
mov edi, dword [ebp - 0x1194]
lea edx, [ebp - 0x1198]
mov eax, dword [ebp - 0x1c]
call fcn.00426f1c
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, edi
call fcn.0040c4b4
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x64b098
mov byte [ebp - 0x74], 1
jmp 0x64b0df
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64dd7c
call fcn.0040c4b4
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x9c]
mov edx, 1
call fcn.0040c3a0
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64dd7c
call fcn.0040c4b4
mov ebx, eax
test ebx, ebx
jg 0x64b026
cmp byte [ebp - 0x74], 0
jne 0x64bd6b
lea edx, [ebp - 0x119c]
mov eax, dword [ebp - 0x1c]
call fcn.00639a94
mov edx, dword [ebp - 0x119c]
lea eax, [ebp - 0x1c]
call fcn.0040b85c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ddc0
call fcn.0040c4b4
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xa0]
mov edx, 1
call fcn.0040c3a0
cmp dword [ebp - 0x1c], 0
jne 0x64b13a
mov al, 1
jmp 0x64b14c
mov eax, dword [ebp - 8]
test eax, eax
je 0x64b146
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x64bd6b
lea eax, [ebp - 0x11a0]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040bfbc
mov eax, dword [ebp - 0x11a0]
mov edx, 1
call fcn.00427ed0
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64b197
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x64b4dd
fild dword [ebp - 0x6c]
fdivr dword [0x64dbe4]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407aa0
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058d28c
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
xor eax, eax
push ebp
push 0x64b220
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x11a4]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov edx, dword [ebp - 0x11a4]
mov eax, dword [0x679db0]
call fcn.0062233c
mov edx, eax
lea ecx, [ebp - 0x52]
mov eax, dword [0x679db0]
call fcn.0061f044
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b22a
lea edx, [ebp - 0x11a8]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x11a8]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64b4dd
cmp byte [0x679dee], 0
je 0x64b260
cmp byte [ebp - 0x18], 0
jne 0x64b260
mov byte [ebp - 0x18], 1
cmp byte [ebp - 0x18], 0
jne case.0x64b2c7.0
cmp byte [ebp - 0x76], 0
jne 0x64b31b
push 0
push 0
lea eax, [ebp - 0x11b0]
push eax
mov ecx, 0x64ceb0
mov edx, 0x64d0c0
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11b0]
lea ecx, [ebp - 0x11ac]
mov edx, dword [ebp - 0x1c]
call fcn.0063a630
mov eax, dword [ebp - 0x11ac]
movzx ecx, word [0x64de04]
xor edx, edx
call fcn.005a13f4
cmp eax, 0xe
ja case.0x64b2c7.0
movzx eax, byte [eax + 0x64b2ce]
jmp dword [eax*4 + 0x64b2dd]
mov byte [ebp - 0x18], 1
jmp case.0x64b2c7.0
mov byte [ebp - 0x18], 3
jmp case.0x64b2c7.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x76], 1
jmp case.0x64b2c7.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x76], 3
jmp case.0x64b2c7.0
mov byte [ebp - 0x18], 3
jmp case.0x64b2c7.0
cmp byte [ebp - 0x76], 1
jne 0x64b327
mov byte [ebp - 0x18], 1
jmp case.0x64b2c7.0
mov byte [ebp - 0x18], 3
cmp byte [ebp - 0x18], 2
jne 0x64b409
xor eax, eax
push ebp
push 0x64b3fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov edx, dword [ebp - 0x11b4]
mov ecx, dword [0x679e10]
mov eax, dword [0x679db0]
call fcn.006208c0
push dword [0x679e10]
push 0x64cf50
lea edx, [ebp - 0x11bc]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
push dword [ebp - 0x11bc]
lea eax, [ebp - 0x11b8]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x11b8]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.006492c8
test al, al
je 0x64b3b3
mov byte [ebp - 0x18], 1
jmp 0x64b3b7
mov byte [ebp - 0x18], 3
push dword [0x679e10]
push 0x64cf50
lea edx, [ebp - 0x11c4]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
push dword [ebp - 0x11c4]
lea eax, [ebp - 0x11c0]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x11c0]
call fcn.00428e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b409
cmp byte [ebp - 0x18], 1
jne 0x64b4b8
xor eax, eax
push ebp
push 0x64b4ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x679df4], 0
je 0x64b48b
push 0
push dword [0x679e10]
push 0x64cf50
lea edx, [ebp - 0x11cc]
mov eax, dword [ebp - 0x1c]
call fcn.004291d0
push dword [ebp - 0x11cc]
push 0x64de14
lea eax, [ebp - 0x11c8]
mov edx, 4
call fcn.0040c270
mov eax, dword [ebp - 0x11c8]
call fcn.0040bf9c
push eax
lea edx, [ebp - 0x11d0]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x11d0]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x11d4]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x11d4]
call fcn.00428e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b4b8
cmp byte [ebp - 0x18], 3
jne 0x64b4dd
mov eax, 0x64de34
call fcn.006368fc
test al, al
jne 0x64bd6b
mov eax, dword [ebp - 0x1c]
call fcn.00649484
jmp 0x64bd6b
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x64b4e9
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x64b528
lea edx, [ebp - 0x11dc]
mov eax, dword [ebp - 0x1c]
call fcn.004290ac
mov eax, dword [ebp - 0x11dc]
lea edx, [ebp - 0x11d8]
call fcn.00636a10
mov eax, dword [ebp - 0x11d8]
mov dl, 1
call fcn.00428884
test al, al
jne 0x64b912
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x11e0]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c358
mov eax, dword [ebp - 0x11e0]
mov edx, 0x64de64
call fcn.0040c320
jne 0x64b5bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x64b57d
mov eax, dword [ebp - 0xa4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xa4]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c358
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64cf50
call fcn.0040c4b4
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x71], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x64b5eb
mov eax, dword [ebp - 0xb0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 0xb0]
sub edx, eax
jl 0x64b908
inc edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x64b8f9
lea eax, [ebp - 0x11e8]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c358
mov eax, dword [ebp - 0x11e8]
lea edx, [ebp - 0x11e4]
call fcn.00636a10
mov eax, dword [ebp - 0x11e4]
mov dl, 1
call fcn.00428884
test al, al
jne 0x64b8f9
xor edx, edx
push ebp
push 0x64b6e4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x11f0]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c358
mov eax, dword [ebp - 0x11f0]
lea edx, [ebp - 0x11ec]
call fcn.00636a10
mov eax, dword [ebp - 0x11ec]
call fcn.004071cc
call fcn.00407170
cmp byte [0x679ded], 0
je 0x64b6d7
cmp byte [ebp - 0x17], 0
je 0x64b6d7
lea eax, [ebp - 0x11f4]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c358
mov edx, dword [ebp - 0x11f4]
mov eax, 0x64de78
call fcn.0063c150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b8f9
inc dword [ebp - 0x64]
dec dword [ebp - 0x88]
jne 0x64b609
cmp byte [ebp - 0x71], 0
jne 0x64bd6b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64b91e
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x64bd6b
lea edx, [ebp - 0x1224]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1224]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64badc
lea edx, [ebp - 0x122c]
mov eax, dword [ebp - 0x1c]
call fcn.0042922c
mov eax, dword [ebp - 0x122c]
lea edx, [ebp - 0x1228]
call fcn.00426f1c
mov eax, dword [ebp - 0x1228]
mov edx, 0x64df94
call fcn.0040c320
jne 0x64b9e6
mov eax, dword [ebp - 0x1c]
call fcn.0062ec24
test al, al
je 0x64b9e6
push 0
push 0
push 0x64dfac
lea edx, [ebp - 0x1234]
mov eax, dword [ebp - 0x1c]
call fcn.004291d0
push dword [ebp - 0x1234]
push 0x64dfe0
lea eax, [ebp - 0x1230]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x1230]
call fcn.0040bf9c
push eax
push 0x64dfe8
push 0x64dff8
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x1238]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1238]
mov dl, 1
call fcn.00428b80
test eax, 1
jle 0x64ba4b
xor eax, eax
push ebp
push 0x64ba41
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x123c]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x123c]
mov cl, 1
mov edx, 0x80
call fcn.00428c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ba4b
lea edx, [ebp - 0x1244]
mov eax, dword [ebp - 0x1c]
call fcn.0042922c
mov eax, dword [ebp - 0x1244]
lea edx, [ebp - 0x1240]
call fcn.00426f1c
mov eax, dword [ebp - 0x1240]
mov edx, 0x64e010
call fcn.0040c320
je 0x64baad
lea edx, [ebp - 0x124c]
mov eax, dword [ebp - 0x1c]
call fcn.0042922c
mov eax, dword [ebp - 0x124c]
lea edx, [ebp - 0x1248]
call fcn.00426f1c
mov eax, dword [ebp - 0x1248]
mov edx, 0x64e028
call fcn.0040c320
jne 0x64badc
lea edx, [ebp - 0x1250]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1250]
call fcn.00649384
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
mov byte [ebp - 0x72], 0
lea edx, [ebp - 0x1254]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1254]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64bb3a
xor eax, eax
push ebp
push 0x64bb30
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1258]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1258]
call fcn.00428e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64bb3a
xor eax, eax
push ebp
push 0x64bb78
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x125c]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov edx, dword [ebp - 0x125c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x679db0]
call fcn.006208ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64bcca
cmp byte [ebp - 0x72], 0
jne 0x64badc
cmp byte [ebp - 0x75], 0
je 0x64bd36
xor eax, eax
push ebp
push 0x64bd0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1270]
mov eax, dword [ebp - 0x1c]
call fcn.00636a10
mov eax, dword [ebp - 0x1270]
mov edx, dword [ebp - 0x4a]
call fcn.00428ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64bd36
cmp byte [0x679ded], 0
je 0x64bd52
cmp byte [ebp - 0x17], 0
je 0x64bd52
mov edx, dword [ebp - 0x1c]
mov eax, 0x64cfa4
call fcn.0063c150
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
cmp dword [ebp - 0x6c], 0x32
jge 0x64bd6b
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64af2c
xor eax, eax
push ebp
push 0x64bda6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x679db0]
call fcn.0062043c
mov eax, dword [0x679db0]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64bdb0
push 0x64e1ec
lea eax, [ebp - 0x1278]
push eax
mov ecx, 0x64e220
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1278]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
mov edx, 0x64e234
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64be7b
mov ecx, dword [ebp - 4]
mov edx, 0x64e234
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64be7b
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x127c]
push eax
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1280]
mov edx, 0x64e234
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x127c]
mov eax, dword [ebp - 0x58]
call fcn.0063e788
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64be36
cmp dword [0x679e40], 0
je 0x64beaa
mov dl, 1
mov eax, dword [0x679e40]
call fcn.00428884
test al, al
jne 0x64beaa
push 0
mov ecx, 0x64d2c4
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x679ded], 0
je 0x64bf37
cmp byte [0x679e55], 0
jne 0x64bf37
push dword [0x679e3c]
push 0x64cf50
push dword [0x679e2c]
lea eax, [ebp - 0x1284]
mov edx, 3
call fcn.0040c270
mov edx, dword [ebp - 0x1284]
mov eax, 0x64cfa4
call fcn.0063c150
push dword [0x679e3c]
push 0x64cf50
lea ecx, [ebp - 0x128c]
mov edx, 0x64cf60
mov eax, dword [0x679e2c]
call fcn.00428f8c
push dword [ebp - 0x128c]
lea eax, [ebp - 0x1288]
mov edx, 3
call fcn.0040c270
mov edx, dword [ebp - 0x1288]
mov eax, 0x64cfa4
call fcn.0063c150
push 0
mov ecx, 0x64d0fc
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64c93b
push 0
mov ecx, 0x64e254
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x64c06d
push 0x64db7c
lea eax, [ebp - 0x1290]
push eax
mov ecx, 0x64dbb0
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1290]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
cmp byte [0x679dee], 0
je 0x64bfc4
mov word [ebp - 0x7e], 0
jmp 0x64bfca
mov word [ebp - 0x7e], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x64e278
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x64bff7
lea eax, [ebp - 0xc]
mov edx, 0x64e2a8
call fcn.0040b85c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x64c01a
mov eax, dword [ebp - 0xb4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jle 0x64c06d
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x64c06d
mov word [ebp - 0x7e], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x64c055
mov eax, dword [ebp - 0xb8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xb8]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c358
push 0
mov ecx, 0x64e254
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x64c092
dec eax
je 0x64c1bc
jmp 0x64c372
push 0
lea eax, [ebp - 0x1298]
push eax
mov ecx, 0x64e2e0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x1298]
lea eax, [ebp - 0x1294]
mov edx, 0x64e308
call fcn.0040c1e8
mov eax, dword [ebp - 0x1294]
lea edx, [ebp - 8]
call fcn.00639a94
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 8]
call fcn.00636a10
mov eax, dword [ebp - 0x129c]
mov dl, 1
call fcn.004287ec
test al, al
jne 0x64c100
lea eax, [ebp - 8]
mov edx, dword [0x679e1c]
call fcn.0040b85c
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 8]
call fcn.00636a10
mov eax, dword [ebp - 0x12a0]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64c1b0
lea edx, [ebp - 0x12a4]
mov eax, 0x64e330
call fcn.00639a94
mov eax, dword [ebp - 0x12a4]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64c1b0
movzx eax, word [ebp - 0x7e]
push eax
push 1
push 0
push 0x64e36c
push dword [ebp - 8]
push 0x64e380
push dword [ebp - 0xc]
lea eax, [ebp - 0x12ac]
mov edx, 4
call fcn.0040c270
mov eax, dword [ebp - 0x12ac]
lea edx, [ebp - 0x12a8]
call fcn.00639a94
mov eax, dword [ebp - 0x12a8]
push eax
lea edx, [ebp - 0x12b0]
mov eax, 0x64e330
call fcn.00639a94
mov eax, dword [ebp - 0x12b0]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055a1e0
pop edx
pop ecx
call fcn.00643284
jmp 0x64c372
mov byte [0x679df5], 1
jmp 0x64c372
push 0
lea eax, [ebp - 0x12b4]
push eax
mov ecx, 0x64e2e0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x12b4]
lea edx, [ebp - 8]
call fcn.00639a94
cmp dword [ebp - 8], 0
je 0x64c36b
lea edx, [ebp - 0x12b8]
mov eax, dword [ebp - 8]
call fcn.006495e8
cmp dword [ebp - 0x12b8], 0
je 0x64c36b
lea edx, [ebp - 0x12bc]
mov eax, 0x64e394
call fcn.00639a94
mov eax, dword [ebp - 0x12bc]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64c36b
push 1
push 1
push 0
push 0x64e3dc
push dword [ebp - 8]
push 0x64e3f4
lea edx, [ebp - 0x12c8]
mov eax, dword [ebp - 8]
call fcn.006495e8
push dword [ebp - 0x12c8]
push 0x64e42c
lea eax, [ebp - 0x12c4]
mov edx, 5
call fcn.0040c270
mov eax, dword [ebp - 0x12c4]
lea edx, [ebp - 0x12c0]
call fcn.00639a94
mov eax, dword [ebp - 0x12c0]
push eax
lea edx, [ebp - 0x12cc]
mov eax, 0x64e394
call fcn.00639a94
mov eax, dword [ebp - 0x12cc]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055a1e0
pop edx
pop ecx
call fcn.00643284
test al, al
je 0x64c362
mov eax, dword [0x679e18]
mov edx, 0x64dc24
call fcn.0040c320
je 0x64c359
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
movzx eax, word [ebp - 0x7e]
push eax
push 1
push 0
push 0x64e43c
lea edx, [ebp - 0x12d8]
mov eax, dword [ebp - 8]
call fcn.006495e8
push dword [ebp - 0x12d8]
push 0x64e380
push dword [ebp - 0xc]
lea eax, [ebp - 0x12d4]
mov edx, 4
call fcn.0040c270
mov eax, dword [ebp - 0x12d4]
lea edx, [ebp - 0x12d0]
call fcn.00639a94
mov eax, dword [ebp - 0x12d0]
push eax
lea edx, [ebp - 0x12dc]
mov eax, 0x64e330
call fcn.00639a94
mov eax, dword [ebp - 0x12dc]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055a1e0
pop edx
pop ecx
call fcn.00643284
test al, al
jne 0x64c372
mov byte [0x679df5], 1
jmp 0x64c372
mov byte [0x679df5], 1
jmp 0x64c372
mov byte [0x679df5], 1
jmp 0x64c372
mov byte [0x679df5], 1
mov eax, dword [0x6724d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x40c]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x64c46a
push 0x64e470
lea eax, [ebp - 0x12e0]
push eax
mov ecx, 0x64e4b0
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
push 0x1f4
call sub.kernel32.dll_Sleep
mov ecx, dword [ebp - 4]
mov edx, 0x64e4c0
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64c44e
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12e4]
push eax
lea ecx, [ebp - 0x12e8]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12e8]
mov edx, 0x64e4c0
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp - 0x58]
call fcn.00641608
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c406
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov edx, 0x64e4e4
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64c53a
push 0x64e504
lea eax, [ebp - 0x12ec]
push eax
mov ecx, 0x64e54c
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12ec]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov ecx, dword [ebp - 4]
mov edx, 0x64e4e4
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64c53a
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
cmp byte [0x679df6], 0
jne 0x64c53a
push 0
lea eax, [ebp - 0x12f0]
push eax
lea edx, [ebp - 0x12f4]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x12f4]
mov edx, 0x64e4e4
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12f0]
mov eax, dword [ebp - 0x58]
call fcn.0063fd70
test al, al
je 0x64c53a
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c4e8
push 0x64e1ec
lea eax, [ebp - 0x12f8]
push eax
mov ecx, 0x64e220
mov edx, 0x64cec4
mov eax, dword [0x679de4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12f8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005505d4
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
mov eax, 0x679e30
call fcn.0040b424
mov edx, 0x64e55c
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64c60f
mov ecx, dword [ebp - 4]
mov edx, 0x64e55c
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64c60f
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12fc]
push eax
lea edx, [ebp - 0x1300]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1300]
mov edx, 0x64e55c
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12fc]
mov eax, dword [ebp - 0x58]
call fcn.00640e94
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c5ca
push 0
mov ecx, 0x64d930
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64c66d
push 0xffffffffffffffff
mov ecx, 0x64d95c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x64c66d
cmp byte [0x679df3], 0
je 0x64c660
mov edx, 0x64e570
mov eax, dword [ebp - 0x58]
call fcn.0063fd70
jmp 0x64c66d
mov edx, 0x64e67c
mov eax, dword [ebp - 0x58]
call fcn.0063fd70
mov eax, dword [0x6724d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x64c6dc
cmp byte [0x679df3], 0
je 0x64c69e
lea eax, [ebp - 8]
mov edx, 0x64e788
call fcn.0040b85c
jmp 0x64c6ab
lea eax, [ebp - 8]
mov edx, 0x64e7b4
call fcn.0040b85c
push dword [ebp - 8]
push 0x64e7e0
push dword [0x679e14]
push 0x64e860
lea eax, [ebp - 0x1304]
mov edx, 4
call fcn.0040c270
mov edx, dword [ebp - 0x1304]
mov eax, dword [ebp - 0x58]
call fcn.0063fd70
mov edx, 0x64e894
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64c7ab
mov ecx, dword [ebp - 4]
mov edx, 0x64e894
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64c76b
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1308]
push eax
lea edx, [ebp - 0x130c]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x130c]
mov edx, 0x64e894
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1308]
mov eax, dword [ebp - 0x58]
call fcn.006420a0
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c726
xor eax, eax
push ebp
push 0x64c7a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x7c]
push eax
push 0x1388
push 2
push 0x64e8b0
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c7ab
mov edx, 0x64e8d4
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64c836
mov ecx, dword [ebp - 4]
mov edx, 0x64e8d4
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64c836
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1310]
push eax
lea edx, [ebp - 0x1314]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1314]
mov edx, 0x64e8d4
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1310]
mov eax, dword [ebp - 0x58]
call fcn.006446a0
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c7f1
mov edx, 0x64e8f0
mov eax, dword [0x679de0]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64c93b
mov ecx, dword [ebp - 4]
mov edx, 0x64e8f0
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64c93b
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1318]
push eax
lea edx, [ebp - 0x131c]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x131c]
mov edx, 0x64e8f0
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x1318]
mov dx, 4
mov eax, dword [ebp - 0x58]
call fcn.00646534
cmp byte [0x679e58], 0
je 0x64c8ee
mov byte [0x679df5], 1
cmp byte [0x679dec], 0
je 0x64c8e7
mov eax, dword [0x679e84]
push eax
call dword [0x679e80]
push ebp
call fcn.00649a04
pop ecx
push 0
lea eax, [ebp - 0x1320]
push eax
lea edx, [ebp - 0x1324]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1324]
mov edx, 0x64e8f0
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x1320]
mov dx, 5
mov eax, dword [ebp - 0x58]
call fcn.00646534
inc dword [ebp - 0x60]
dec dword [ebp - 0x84]
jne 0x64c884
cmp byte [0x679dec], 0
je 0x64c972
xor eax, eax
push ebp
push 0x64c968
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x679e84]
push eax
call dword [0x679e80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c972
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
mov edx, 0x64
call fcn.0058d28c
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x679ded], 0
je 0x64c9c3
push 0
mov ecx, 0x64e910
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64c9c3
call fcn.00648668
push 0
mov ecx, 0x64d988
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x64c9fb
push 0
mov ecx, 0x64d8cc
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64cab8
lea edx, [ebp - 0x1328]
mov eax, 0x64e394
call fcn.00639a94
mov eax, dword [ebp - 0x1328]
mov dl, 1
call fcn.004287ec
test al, al
je 0x64cab8
xor eax, eax
push ebp
push 0x64caae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x1330]
mov eax, 0x64e938
call fcn.00639a94
mov eax, dword [ebp - 0x1330]
lea edx, [ebp - 0x132c]
call fcn.00636a10
mov eax, dword [ebp - 0x132c]
call fcn.0040bf9c
push eax
lea eax, [ebp - 0x1334]
mov ecx, 0x64e97c
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1334]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1338]
mov eax, 0x64e938
call fcn.00639a94
mov edx, dword [ebp - 0x1338]
mov eax, 0x64cfa4
call fcn.0063c150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64cab8
xor eax, eax
push ebp
push 0x64cae2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x679e64]
call fcn.00409670
mov eax, dword [ebp - 4]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64caec
cmp byte [0x679e5a], 0
je 0x64cb19
mov eax, dword [0x679e3c]
call fcn.00649680
test al, al
jne 0x64cb19
push 0
mov ecx, 0x64d368
mov edx, 0x64d050
mov eax, dword [0x679de8]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
push ebp
push 0x64cb45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x679de8]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x679de8]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64cb4f
cmp byte [0x679ded], 0
je 0x64cc52
push 0
push dword [0x679e3c]
push 0x64cf50
push dword [0x679e2c]
lea eax, [ebp - 0x1340]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x1340]
lea edx, [ebp - 0x133c]
call fcn.00636a10
mov eax, dword [ebp - 0x133c]
call fcn.0040bf9c
push eax
lea eax, [ebp - 0x1344]
mov ecx, 0x64e9a8
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1344]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x64cc4b
push 0
push dword [0x679e3c]
push 0x64cf50
lea ecx, [ebp - 0x1350]
mov edx, 0x64cf60
mov eax, dword [0x679e2c]
call fcn.00428f8c
push dword [ebp - 0x1350]
lea eax, [ebp - 0x134c]
mov edx, 3
call fcn.0040c270
mov eax, dword [ebp - 0x134c]
lea edx, [ebp - 0x1348]
call fcn.00636a10
mov eax, dword [ebp - 0x1348]
call fcn.0040bf9c
push eax
lea eax, [ebp - 0x1354]
mov ecx, 0x64cf78
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1354]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x64cc52
mov byte [0x679df5], 1
cmp byte [0x679ded], 0
jne 0x64cd11
push 0
mov ecx, 0x64d1d0
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64cd11
lea eax, [ebp - 0x135c]
mov ecx, 0x64e9d4
mov edx, dword [0x679e3c]
call fcn.0040c1e8
mov eax, dword [ebp - 0x135c]
lea edx, [ebp - 0x1358]
call fcn.00636a10
mov eax, dword [ebp - 0x1358]
mov dl, 1
call fcn.004287ec
test al, al
jne 0x64cd11
push 0
lea eax, [ebp - 0x1364]
mov ecx, 0x64e9d4
mov edx, dword [0x679e3c]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1364]
lea edx, [ebp - 0x1360]
call fcn.00636a10
mov eax, dword [ebp - 0x1360]
call fcn.0040bf9c
push eax
lea eax, [ebp - 0x1368]
mov ecx, 0x64cf78
mov edx, dword [0x679e10]
call fcn.0040c1e8
mov eax, dword [ebp - 0x1368]
call fcn.0040bf9c
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x64d930
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64cd9f
push 0xffffffffffffffff
mov ecx, 0x64d95c
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x64cd9f
push 5
push 0
push 1
lea edx, [ebp - 0x1370]
mov eax, dword [ebp - 0x60]
call fcn.00427c3c
mov ecx, dword [ebp - 0x1370]
lea eax, [ebp - 0x136c]
mov edx, 0x64e9fc
call fcn.0040c1e8
mov eax, dword [ebp - 0x136c]
push eax
lea eax, [ebp - 0x1374]
mov ecx, 0x64ea28
mov edx, dword [0x679e3c]
call fcn.0040c1e8
mov edx, dword [ebp - 0x1374]
xor eax, eax
pop ecx
call fcn.00643284
mov eax, dword [0x672268]
mov eax, dword [eax]
call fcn.0060b46c
mov byte [0x679e57], 1
mov byte [0x679df7], 0
push 0x3e8
call sub.kernel32.dll_Sleep
cmp byte [0x679dee], 0
jne 0x64cded
push 0
mov ecx, 0x64ea50
mov edx, 0x64cf38
mov eax, dword [0x679de0]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64cded
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64ce73
lea eax, [ebp - 0x1374]
mov edx, 0x63
call fcn.0040b484
lea eax, [ebp - 0x11e4]
call fcn.0040b424
lea eax, [ebp - 0x11e8]
call fcn.0040b424
lea eax, [ebp - 0x11e0]
mov edx, 0x18
call fcn.0040b484
lea eax, [ebp - 0x1178]
mov edx, 0x30
call fcn.0040b484
lea eax, [ebp - 0x52]
mov edx, dword [0x61994c]
call fcn.0040cb00
lea eax, [ebp - 0x1c]
mov edx, dword [0x6499a4]
call fcn.0040cb00
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b484
pop eax
jmp eax