Function at 0x40dc90
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Delete file
Enumerate gui resources
Hide graphical window
Read .ini file
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c5bd
mov eax, dword fs:[0]
push eax
mov eax, 0x1c78
call fcn.00416ba0
mov eax, dword [0x439b10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1444], 0
push 0
push str.taskkill__f__im_audiosrv2.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push str.C:WindowsSysWOW64_audiosrv2.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:WindowsSystem32_audiosrv2.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.004091a0
push 0x42d29c
lea ecx, [ebp - 0x28]
call fcn.00401f00
mov dword [ebp - 4], 0
push 0x42d29c
lea ecx, [ebp - 0x40]
call fcn.00401f00
mov byte [ebp - 4], 1
mov dword [ebp - 0x44], 1
jmp 0x40dd2b
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp + 8]
jge 0x40dd5f
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x40]
call fcn.00408630
mov eax, dword [ebp + 8]
sub eax, 1
cmp dword [ebp - 0x44], eax
je 0x40dd5d
push 0x42d75c
lea ecx, [ebp - 0x40]
call fcn.00408630
jmp 0x40dd22
cmp dword [ebp + 8], 1
jle 0x40de23
cmp dword [ebp + 8], 2
jle 0x40dd87
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x28]
call fcn.004084c0
jmp 0x40dd9e
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x28]
call fcn.004084c0
push str.XN100
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40ddff
push 0x42d29c
lea ecx, [ebp - 0x28]
call fcn.004084c0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x28]
call fcn.004084c0
push 0x42d768
lea ecx, [ebp - 0x28]
call fcn.00408630
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x28]
call fcn.00408630
jmp 0x40de23
push 0x42d29c
lea ecx, [ebp - 0x28]
call fcn.004084c0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x28]
call fcn.004084c0
lea ecx, [ebp - 0x5c]
call fcn.00401fa0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00401fa0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00401fa0
mov byte [ebp - 4], 4
push 0x42d29c
lea ecx, [ebp - 0xa4]
call fcn.00401f00
mov byte [ebp - 4], 5
push 0x42d29c
lea ecx, [ebp - 0xbc]
call fcn.00401f00
mov byte [ebp - 4], 6
push 0x42d29c
lea ecx, [ebp - 0xd4]
call fcn.00401f00
mov byte [ebp - 4], 7
push 0x42d29c
lea ecx, [ebp - 0xec]
call fcn.00401f00
mov byte [ebp - 4], 8
push 0x42d29c
lea ecx, [ebp - 0x104]
call fcn.00401f00
mov byte [ebp - 4], 9
push 0x42d29c
lea ecx, [ebp - 0x11c]
call fcn.00401f00
mov byte [ebp - 4], 0xa
push 0x42d29c
lea ecx, [ebp - 0x134]
call fcn.00401f00
mov byte [ebp - 4], 0xb
push 0x42d29c
lea ecx, [ebp - 0x14c]
call fcn.00401f00
mov byte [ebp - 4], 0xc
push 0x42d29c
lea ecx, [ebp - 0x164]
call fcn.00401f00
mov byte [ebp - 4], 0xd
push 0x42d29c
lea ecx, [ebp - 0x17c]
call fcn.00401f00
mov byte [ebp - 4], 0xe
push 0x42d29c
lea ecx, [ebp - 0x194]
call fcn.00401f00
mov byte [ebp - 4], 0xf
push 0x42d29c
lea ecx, [ebp - 0x1ac]
call fcn.00401f00
mov byte [ebp - 4], 0x10
push 0x42d29c
lea ecx, [ebp - 0x1c4]
call fcn.00401f00
mov byte [ebp - 4], 0x11
push 0x42d29c
lea ecx, [ebp - 0x1dc]
call fcn.00401f00
mov byte [ebp - 4], 0x12
push 0x42d29c
lea ecx, [ebp - 0x1f4]
call fcn.00401f00
mov byte [ebp - 4], 0x13
push str.START_QFPT
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e549
cmp dword [ebp + 8], 6
jne 0x40e2f4
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0xa4]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0xbc]
call fcn.004084c0
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0xd4]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0xec]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0xa4]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e02e
push 0x42d29c
lea ecx, [ebp - 0xa4]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0xbc]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e059
push 0x42d29c
lea ecx, [ebp - 0xbc]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0xd4]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e084
push 0x42d29c
lea ecx, [ebp - 0xd4]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0xec]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e0af
push 0x42d29c
lea ecx, [ebp - 0xec]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0xec]
push eax
push 0x42d780
lea ecx, [ebp - 0xd4]
push ecx
push 0x42d780
lea edx, [ebp - 0xbc]
push edx
push 0x42d780
lea eax, [ebp - 0xa4]
push eax
push 0x42d780
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1c20]
push edx
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x1c08]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1c30]
push ecx
lea edx, [ebp - 0x1bf0]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1c38]
push ecx
lea edx, [ebp - 0x1bd8]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov eax, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x1c40]
push ecx
lea edx, [ebp - 0x1bc0]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1c48]
push ecx
lea edx, [ebp - 0x1ba8]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov eax, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x1c50]
push ecx
lea edx, [ebp - 0x1b90]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov eax, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], eax
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x1c58]
push ecx
lea edx, [ebp - 0x1b78]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov eax, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x1c60]
push ecx
lea edx, [ebp - 0x1b60]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov eax, dword [ebp - 0x1c64]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402230
lea ecx, [ebp - 0x1b60]
call fcn.00402160
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1b78]
call fcn.00402160
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1b90]
call fcn.00402160
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1ba8]
call fcn.00402160
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1bc0]
call fcn.00402160
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1bd8]
call fcn.00402160
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1bf0]
call fcn.00402160
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1c08]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1c20]
call fcn.00402160
jmp 0x40e544
push 0x42d29c
lea ecx, [ebp - 0xec]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0xec]
push eax
push 0x42d780
lea ecx, [ebp - 0xd4]
push ecx
push 0x42d780
lea edx, [ebp - 0xbc]
push edx
push 0x42d780
lea eax, [ebp - 0xa4]
push eax
push 0x42d780
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1b48]
push edx
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x1b30]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], eax
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x1c30]
push ecx
lea edx, [ebp - 0x1b18]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], eax
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x1c38]
push ecx
lea edx, [ebp - 0x1b00]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov eax, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x1c40]
push ecx
lea edx, [ebp - 0x1ae8]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x1c48]
push ecx
lea edx, [ebp - 0x1ad0]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov eax, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x1c50]
push ecx
lea edx, [ebp - 0x1ab8]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov eax, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x1c58]
push ecx
lea edx, [ebp - 0x1aa0]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov eax, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], eax
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x1c60]
push ecx
lea edx, [ebp - 0x1a88]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov eax, dword [ebp - 0x1c64]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402230
lea ecx, [ebp - 0x1a88]
call fcn.00402160
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1aa0]
call fcn.00402160
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1ab8]
call fcn.00402160
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1ad0]
call fcn.00402160
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1ae8]
call fcn.00402160
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1b00]
call fcn.00402160
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1b18]
call fcn.00402160
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1b30]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1b48]
call fcn.00402160
jmp 0x40f989
push str.START_XN100
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40efc9
cmp dword [ebp + 8], 7
jne 0x40e8c8
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x104]
call fcn.004084c0
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x11c]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x134]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x164]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x104]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e602
push 0x42d29c
lea ecx, [ebp - 0x104]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x11c]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e62d
push 0x42d29c
lea ecx, [ebp - 0x11c]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x134]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e658
push 0x42d29c
lea ecx, [ebp - 0x134]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x164]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e683
push 0x42d29c
lea ecx, [ebp - 0x164]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0x164]
push eax
push 0x42d780
lea ecx, [ebp - 0x134]
push ecx
push 0x42d780
lea edx, [ebp - 0x11c]
push edx
push 0x42d780
lea eax, [ebp - 0x104]
push eax
push 0x42d780
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1a2c]
push edx
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x1a14]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], eax
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x1c30]
push ecx
lea edx, [ebp - 0x19fc]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], eax
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x1c38]
push ecx
lea edx, [ebp - 0x19e4]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov eax, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], eax
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x1c40]
push ecx
lea edx, [ebp - 0x19cc]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], eax
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x1c48]
push ecx
lea edx, [ebp - 0x19b4]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov eax, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], eax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x1c50]
push ecx
lea edx, [ebp - 0x199c]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov eax, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], eax
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x1c58]
push ecx
lea edx, [ebp - 0x1984]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov eax, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x1c60]
push ecx
lea edx, [ebp - 0x1968]
push edx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov eax, dword [ebp - 0x1c64]
push eax
lea ecx, [ebp - 0x74]
call fcn.00402230
lea ecx, [ebp - 0x1968]
call fcn.00402160
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1984]
call fcn.00402160
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x199c]
call fcn.00402160
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x19b4]
call fcn.00402160
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x19cc]
call fcn.00402160
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x19e4]
call fcn.00402160
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x19fc]
call fcn.00402160
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1a14]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1a2c]
call fcn.00402160
jmp 0x40efc4
cmp dword [ebp + 8], 8
jne 0x40ecf2
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x104]
call fcn.004084c0
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x11c]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x134]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x14c]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x164]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x104]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e97f
push 0x42d29c
lea ecx, [ebp - 0x104]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x11c]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e9aa
push 0x42d29c
lea ecx, [ebp - 0x11c]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x134]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40e9d5
push 0x42d29c
lea ecx, [ebp - 0x134]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x14c]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40ea00
push 0x42d29c
lea ecx, [ebp - 0x14c]
call fcn.004084c0
push str.000000
lea eax, [ebp - 0x164]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40ea2b
push 0x42d29c
lea ecx, [ebp - 0x164]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0x164]
push eax
push 0x42d780
lea ecx, [ebp - 0x14c]
push ecx
push 0x42d780
lea edx, [ebp - 0x134]
push edx
push 0x42d780
lea eax, [ebp - 0x11c]
push eax
push 0x42d780
lea ecx, [ebp - 0x104]
push ecx
push 0x42d780
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x1908]
push eax
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], ecx
mov byte [ebp - 4], 0x2c
mov edx, dword [ebp - 0x1c28]
push edx
lea eax, [ebp - 0x18ec]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov ecx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], ecx
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x1c30]
push edx
lea eax, [ebp - 0x18d0]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], ecx
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x1c38]
push edx
lea eax, [ebp - 0x18b8]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov ecx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], ecx
mov byte [ebp - 4], 0x2f
mov edx, dword [ebp - 0x1c40]
push edx
lea eax, [ebp - 0x18a0]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov ecx, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], ecx
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x1c48]
push edx
lea eax, [ebp - 0x1888]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov ecx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], ecx
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x1c50]
push edx
lea eax, [ebp - 0x1870]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov ecx, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], ecx
mov byte [ebp - 4], 0x32
mov edx, dword [ebp - 0x1c58]
push edx
lea eax, [ebp - 0x1858]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov ecx, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], ecx
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x1c60]
push edx
lea eax, [ebp - 0x183c]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov ecx, dword [ebp - 0x1c64]
mov dword [ebp - 0x1c68], ecx
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x1c68]
push edx
lea eax, [ebp - 0x1824]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c6c], eax
mov ecx, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1c70], ecx
mov byte [ebp - 4], 0x35
mov edx, dword [ebp - 0x1c70]
push edx
lea eax, [ebp - 0x1808]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c74], eax
mov ecx, dword [ebp - 0x1c74]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00402230
lea ecx, [ebp - 0x1808]
call fcn.00402160
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1824]
call fcn.00402160
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x183c]
call fcn.00402160
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x1858]
call fcn.00402160
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1870]
call fcn.00402160
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x1888]
call fcn.00402160
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x18a0]
call fcn.00402160
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x18b8]
call fcn.00402160
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x18d0]
call fcn.00402160
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x18ec]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1908]
call fcn.00402160
jmp 0x40efc4
push str.340000
lea ecx, [ebp - 0x164]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0x164]
push eax
push 0x42d780
lea ecx, [ebp - 0x14c]
push ecx
push 0x42d780
lea edx, [ebp - 0x134]
push edx
push 0x42d780
lea eax, [ebp - 0x11c]
push eax
push 0x42d780
lea ecx, [ebp - 0x104]
push ecx
push 0x42d780
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x17ec]
push eax
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], ecx
mov byte [ebp - 4], 0x36
mov edx, dword [ebp - 0x1c28]
push edx
lea eax, [ebp - 0x17d4]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov ecx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], ecx
mov byte [ebp - 4], 0x37
mov edx, dword [ebp - 0x1c30]
push edx
lea eax, [ebp - 0x17bc]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], ecx
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0x1c38]
push edx
lea eax, [ebp - 0x17a4]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov ecx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], ecx
mov byte [ebp - 4], 0x39
mov edx, dword [ebp - 0x1c40]
push edx
lea eax, [ebp - 0x178c]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov ecx, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], ecx
mov byte [ebp - 4], 0x3a
mov edx, dword [ebp - 0x1c48]
push edx
lea eax, [ebp - 0x1774]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov ecx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], ecx
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0x1c50]
push edx
lea eax, [ebp - 0x175c]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov ecx, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], ecx
mov byte [ebp - 4], 0x3c
mov edx, dword [ebp - 0x1c58]
push edx
lea eax, [ebp - 0x1744]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov ecx, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], ecx
mov byte [ebp - 4], 0x3d
mov edx, dword [ebp - 0x1c60]
push edx
lea eax, [ebp - 0x172c]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov ecx, dword [ebp - 0x1c64]
mov dword [ebp - 0x1c68], ecx
mov byte [ebp - 4], 0x3e
mov edx, dword [ebp - 0x1c68]
push edx
lea eax, [ebp - 0x1714]
push eax
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c6c], eax
mov ecx, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1c70], ecx
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0x1c70]
push edx
lea eax, [ebp - 0x16fc]
push eax
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c74], eax
mov ecx, dword [ebp - 0x1c74]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00402230
lea ecx, [ebp - 0x16fc]
call fcn.00402160
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1714]
call fcn.00402160
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x172c]
call fcn.00402160
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1744]
call fcn.00402160
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x175c]
call fcn.00402160
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1774]
call fcn.00402160
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x178c]
call fcn.00402160
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17a4]
call fcn.00402160
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x17bc]
call fcn.00402160
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x17d4]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x17ec]
call fcn.00402160
jmp 0x40f989
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40f989
cmp dword [ebp + 8], 8
jl 0x40f3d6
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x17c]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x194]
call fcn.004084c0
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
lea ecx, [ebp - 0x1ac]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.004084c0
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
lea ecx, [ebp - 0x1f4]
call fcn.004084c0
push 0x42d780
lea eax, [ebp - 0x1f4]
push eax
push 0x42d780
lea ecx, [ebp - 0x1dc]
push ecx
push 0x42d780
lea edx, [ebp - 0x1c4]
push edx
push 0x42d780
lea eax, [ebp - 0x1ac]
push eax
push 0x42d780
lea ecx, [ebp - 0x194]
push ecx
push 0x42d780
lea edx, [ebp - 0x17c]
push edx
push 0x42d780
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x16e4]
push ecx
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov edx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], edx
mov byte [ebp - 4], 0x40
mov eax, dword [ebp - 0x1c28]
push eax
lea ecx, [ebp - 0x16cc]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov edx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], edx
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x1c30]
push eax
lea ecx, [ebp - 0x16b4]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov edx, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], edx
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x1c38]
push eax
lea ecx, [ebp - 0x169c]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov edx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], edx
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x1c40]
push eax
lea ecx, [ebp - 0x1684]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov edx, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], edx
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x1c48]
push eax
lea ecx, [ebp - 0x166c]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov edx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], edx
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x1c50]
push eax
lea ecx, [ebp - 0x1654]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov edx, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], edx
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0x1c58]
push eax
lea ecx, [ebp - 0x163c]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov edx, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], edx
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x1c60]
push eax
lea ecx, [ebp - 0x1624]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov edx, dword [ebp - 0x1c64]
mov dword [ebp - 0x1c68], edx
mov byte [ebp - 4], 0x48
mov eax, dword [ebp - 0x1c68]
push eax
lea ecx, [ebp - 0x160c]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c6c], eax
mov edx, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1c70], edx
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x1c70]
push eax
lea ecx, [ebp - 0x15f4]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c74], eax
mov edx, dword [ebp - 0x1c74]
mov dword [ebp - 0x1c78], edx
mov byte [ebp - 4], 0x4a
mov eax, dword [ebp - 0x1c78]
push eax
lea ecx, [ebp - 0x15dc]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c7c], eax
mov edx, dword [ebp - 0x1c7c]
mov dword [ebp - 0x1c80], edx
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x1c80]
push eax
lea ecx, [ebp - 0x15c4]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c84], eax
mov edx, dword [ebp - 0x1c84]
push edx
lea ecx, [ebp - 0x8c]
call fcn.00402230
lea ecx, [ebp - 0x15c4]
call fcn.00402160
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x15dc]
call fcn.00402160
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x15f4]
call fcn.00402160
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x160c]
call fcn.00402160
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1624]
call fcn.00402160
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x163c]
call fcn.00402160
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1654]
call fcn.00402160
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x166c]
call fcn.00402160
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x1684]
call fcn.00402160
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x169c]
call fcn.00402160
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x16b4]
call fcn.00402160
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x16cc]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x16e4]
call fcn.00402160
jmp 0x40f81e
mov dword [ebp - 0x1f8], 2
jmp 0x40f3f1
mov eax, dword [ebp - 0x1f8]
add eax, 1
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp + 8]
jge 0x40f4d7
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
sub ecx, 2
mov dword [ebp - 0x1c24], ecx
cmp dword [ebp - 0x1c24], 5
ja case.default.0x40f42e
mov edx, dword [ebp - 0x1c24]
jmp dword [edx*4 + 0x411500]
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x17c]
call fcn.004084c0
jmp case.default.0x40f42e
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x194]
call fcn.004084c0
jmp case.default.0x40f42e
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x1ac]
call fcn.004084c0
jmp case.default.0x40f42e
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x1c4]
call fcn.004084c0
jmp case.default.0x40f42e
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x1dc]
call fcn.004084c0
jmp case.default.0x40f42e
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea ecx, [ebp - 0x1f4]
call fcn.004084c0
jmp 0x40f3e2
push 0x42d780
lea eax, [ebp - 0x1f4]
push eax
push 0x42d780
lea ecx, [ebp - 0x1dc]
push ecx
push 0x42d780
lea edx, [ebp - 0x1c4]
push edx
push 0x42d780
lea eax, [ebp - 0x1ac]
push eax
push 0x42d780
lea ecx, [ebp - 0x194]
push ecx
push 0x42d780
lea edx, [ebp - 0x17c]
push edx
push 0x42d780
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x15ac]
push ecx
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov edx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], edx
mov byte [ebp - 4], 0x4c
mov eax, dword [ebp - 0x1c28]
push eax
lea ecx, [ebp - 0x1594]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov edx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], edx
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x1c30]
push eax
lea ecx, [ebp - 0x157c]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c34], eax
mov edx, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], edx
mov byte [ebp - 4], 0x4e
mov eax, dword [ebp - 0x1c38]
push eax
lea ecx, [ebp - 0x1564]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c3c], eax
mov edx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], edx
mov byte [ebp - 4], 0x4f
mov eax, dword [ebp - 0x1c40]
push eax
lea ecx, [ebp - 0x154c]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c44], eax
mov edx, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], edx
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x1c48]
push eax
lea ecx, [ebp - 0x1534]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c4c], eax
mov edx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], edx
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0x1c50]
push eax
lea ecx, [ebp - 0x151c]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c54], eax
mov edx, dword [ebp - 0x1c54]
mov dword [ebp - 0x1c58], edx
mov byte [ebp - 4], 0x52
mov eax, dword [ebp - 0x1c58]
push eax
lea ecx, [ebp - 0x1504]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c5c], eax
mov edx, dword [ebp - 0x1c5c]
mov dword [ebp - 0x1c60], edx
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x1c60]
push eax
lea ecx, [ebp - 0x14ec]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c64], eax
mov edx, dword [ebp - 0x1c64]
mov dword [ebp - 0x1c68], edx
mov byte [ebp - 4], 0x54
mov eax, dword [ebp - 0x1c68]
push eax
lea ecx, [ebp - 0x14d4]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c6c], eax
mov edx, dword [ebp - 0x1c6c]
mov dword [ebp - 0x1c70], edx
mov byte [ebp - 4], 0x55
mov eax, dword [ebp - 0x1c70]
push eax
lea ecx, [ebp - 0x14bc]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c74], eax
mov edx, dword [ebp - 0x1c74]
mov dword [ebp - 0x1c78], edx
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0x1c78]
push eax
lea ecx, [ebp - 0x14a4]
push ecx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c7c], eax
mov edx, dword [ebp - 0x1c7c]
mov dword [ebp - 0x1c80], edx
mov byte [ebp - 4], 0x57
mov eax, dword [ebp - 0x1c80]
push eax
lea ecx, [ebp - 0x148c]
push ecx
call fcn.00406b70
add esp, 0xc
mov dword [ebp - 0x1c84], eax
mov edx, dword [ebp - 0x1c84]
push edx
lea ecx, [ebp - 0x8c]
call fcn.00402230
lea ecx, [ebp - 0x148c]
call fcn.00402160
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x14a4]
call fcn.00402160
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x14bc]
call fcn.00402160
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x14d4]
call fcn.00402160
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x14ec]
call fcn.00402160
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x1504]
call fcn.00402160
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x151c]
call fcn.00402160
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1534]
call fcn.00402160
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x154c]
call fcn.00402160
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1564]
call fcn.00402160
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x157c]
call fcn.00402160
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1594]
call fcn.00402160
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x15ac]
call fcn.00402160
push 0x42d29c
lea eax, [ebp - 0x1f4]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40f989
push 0x40
push 0x42d7a8
push 0x42d7b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x1a70], 0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
mov eax, dword [ebp - 0x1a70]
jmp 0x4114e4
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x40f9d1
push str.START_QFPT
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x40f9d1
push str.START_XN100
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40fa30
push 0
push 0x408cc0
call dword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [0x43c3e4]
test eax, eax
je 0x40fa30
push str.aisvr.exe
call fcn.00408ff0
add esp, 4
movzx eax, al
cmp eax, 1
jne 0x40fa0b
push 0
push str.taskkill__f__im_aisvr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_qdfpzs.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_skfpd.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.aisvr.exe
call fcn.00408ff0
add esp, 4
movzx eax, al
test eax, eax
jne 0x40fab7
mov byte [ebp - 0x3ec], 0
push 0x1f3
push 0
lea eax, [ebp - 0x3eb]
push eax
call fcn.00414fd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3ec]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040d1c0
add esp, 8
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a6c], esp
lea eax, [ebp - 0x3ec]
push eax
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
lea eax, [ebp - 0x1474]
push eax
call fcn.00408df0
add esp, 4
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
push ecx
mov ecx, 0x43c3e8
call fcn.00402230
lea ecx, [ebp - 0x1474]
call fcn.00402160
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 0x3f0], eax
push 0x42d838
push 0x1003
mov eax, dword [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push str.yyyy_MM_dd
push 0x1f
mov eax, dword [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push str.yyyy_MM_dd
push 0x20
mov eax, dword [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
xor eax, eax
mov word [ebp - 0x7d8], ax
push 0x3e6
push 0
lea eax, [ebp - 0x7d6]
push eax
call fcn.00414fd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x7d8]
push eax
call fcn.0040d8a0
add esp, 8
mov ecx, 2
imul edx, ecx, 0
xor ecx, ecx
mov word [eax + edx], cx
push 0xb8
lea ecx, [ebp - 0x890]
call fcn.0040ad70
push 1
push 0x40
push 0x61
push 0x42d8a0
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0x145c]
call fcn.00407570
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], ecx
mov byte [ebp - 4], 0x58
mov edx, dword [ebp - 0x1c28]
push edx
lea eax, [ebp - 0x1440]
push eax
call fcn.00406d40
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov ecx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], ecx
mov byte [ebp - 4], 0x59
mov edx, dword [ebp - 0x1c30]
push edx
lea ecx, [ebp - 0x890]
call fcn.00407250
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x1440]
call fcn.004080f0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x145c]
call fcn.004080f0
mov eax, dword [ebp - 0x890]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x890]
call fcn.004084f0
movzx edx, al
test edx, edx
je 0x40fc4b
lea ecx, [ebp - 0x890]
call fcn.0040b5f0
push 2
push 0
push 0
lea ecx, [ebp - 0x890]
call fcn.0040ca90
lea eax, [ebp - 0x1a68]
push eax
lea ecx, [ebp - 0x890]
call fcn.0040d2a0
mov ecx, eax
call fcn.00408530
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0
jle 0x410039
push 0
push 0
push 0
lea ecx, [ebp - 0x890]
call fcn.0040ca90
mov eax, dword [ebp - 0x894]
push eax
call fcn.00411a74
add esp, 4
mov dword [ebp - 0x1a50], eax
mov ecx, dword [ebp - 0x1a50]
mov dword [ebp - 0x898], ecx
mov eax, dword [ebp - 0x894]
cdq
push edx
push eax
mov eax, dword [ebp - 0x898]
push eax
lea ecx, [ebp - 0x890]
call fcn.0040c8d0
mov eax, dword [ebp - 0x894]
push eax
mov ecx, dword [ebp - 0x898]
push ecx
lea ecx, [ebp - 0x8b0]
call fcn.00401f50
mov byte [ebp - 4], 0x5d
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x1a4c], eax
mov ecx, dword [ebp - 0x1a4c]
push ecx
call fcn.00412da4
add esp, 4
cmp dword [ebp - 0x1a4c], 0
jne 0x40fd22
mov dword [ebp - 0x1c24], 0
jmp 0x40fd38
mov dword [ebp - 0x898], 0x8123
mov edx, dword [ebp - 0x898]
mov dword [ebp - 0x1c24], edx
lea ecx, [ebp - 0x890]
call fcn.0040b5f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a48], esp
lea eax, [ebp - 0x8b0]
push eax
call fcn.00401e50
mov dword [ebp - 0x1c24], eax
lea ecx, [ebp - 0x8c8]
push ecx
call fcn.004115a0
add esp, 0x1c
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x5e
mov byte [ebp - 0x8d8], 0x24
mov byte [ebp - 0x8d7], 0x97
mov byte [ebp - 0x8d6], 0x82
mov byte [ebp - 0x8d5], 0x10
mov byte [ebp - 0x8d4], 5
mov byte [ebp - 0x8d3], 0x49
mov byte [ebp - 0x8d2], 0x33
mov byte [ebp - 0x8d1], 0x47
mov byte [ebp - 0x8d0], 0x86
mov byte [ebp - 0x8cf], 0x26
mov byte [ebp - 0x8ce], 0x51
mov byte [ebp - 0x8cd], 3
mov byte [ebp - 0x8cc], 0x93
mov byte [ebp - 0x8cb], 0x16
mov byte [ebp - 0x8ca], 0x45
mov byte [ebp - 0x8c9], 0x71
mov byte [ebp - 0x8e8], 0x32
mov byte [ebp - 0x8e7], 0x70
mov byte [ebp - 0x8e6], 0x72
mov byte [ebp - 0x8e5], 0x35
mov byte [ebp - 0x8e4], 0x44
mov byte [ebp - 0x8e3], 0x46
mov byte [ebp - 0x8e2], 9
mov byte [ebp - 0x8e1], 6
mov byte [ebp - 0x8e0], 0x86
mov byte [ebp - 0x8df], 0x37
mov byte [ebp - 0x8de], 0x41
mov byte [ebp - 0x8dd], 0x84
mov byte [ebp - 0x8dc], 0x22
mov byte [ebp - 0x8db], 0x28
mov byte [ebp - 0x8da], 4
mov byte [ebp - 0x8d9], 0x55
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a44], esp
push 0x42d29c
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x5f
push 0x10
lea ecx, [ebp - 0x8e8]
push ecx
push 0x10
lea edx, [ebp - 0x8d8]
push edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a40], esp
lea eax, [ebp - 0x8c8]
push eax
call fcn.00401e50
mov dword [ebp - 0x1c2c], eax
lea ecx, [ebp - 0x900]
push ecx
mov byte [ebp - 4], 0x5e
call fcn.00402580
add esp, 0x44
mov dword [ebp - 0x1c30], eax
mov byte [ebp - 4], 0x60
push 0x42d29c
lea eax, [ebp - 0x900]
push eax
call fcn.00406b30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41000a
push 0xc
lea ecx, [ebp - 0x90c]
call fcn.0040ad70
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a3c], esp
push 0x42d3d4
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
lea eax, [ebp - 0x900]
push eax
lea ecx, [ebp - 0x90c]
push ecx
call fcn.00411870
add esp, 0x20
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x61
mov dword [ebp - 0x910], 0
jmp 0x40ff52
mov eax, dword [ebp - 0x910]
add eax, 1
mov dword [ebp - 0x910], eax
lea ecx, [ebp - 0x90c]
call fcn.00406780
cmp dword [ebp - 0x910], eax
jae 0x40fffb
mov eax, dword [ebp - 0x910]
push eax
lea ecx, [ebp - 0x90c]
call fcn.00408510
mov ecx, eax
call fcn.00405860
movzx ecx, al
test ecx, ecx
jne 0x40fff6
push 0x42d29c
mov eax, dword [ebp - 0x910]
push eax
lea ecx, [ebp - 0x90c]
call fcn.00408510
push eax
call fcn.00406b30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40fff6
mov eax, dword [ebp - 0x910]
push eax
lea ecx, [ebp - 0x90c]
call fcn.00408510
push eax
push str.taskkill__f__im
lea ecx, [ebp - 0x928]
push ecx
call fcn.00406c80
add esp, 0xc
push 0
lea ecx, [ebp - 0x928]
call fcn.004054f0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x928]
call fcn.00402160
jmp 0x40ff43
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x90c]
call fcn.00402180
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x900]
call fcn.00402160
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x8c8]
call fcn.00402160
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x8b0]
call fcn.00402160
jmp 0x410044
lea ecx, [ebp - 0x890]
call fcn.0040b5f0
mov byte [ebp - 0x929], 0
push str.qdfpzsShell
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x930], 0
je 0x410076
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4100a0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a38], esp
push str.Mutex
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
mov byte [ebp - 0x929], 1
mov byte [ebp - 0x931], 0
mov eax, dword [str.skfpd.exe]
mov dword [ebp - 0x9b4], eax
mov ecx, dword [0x42d8e0]
mov dword [ebp - 0x9b0], ecx
mov dx, word [0x42d8e4]
mov word [ebp - 0x9ac], dx
push 0x76
push 0
lea eax, [ebp - 0x9aa]
push eax
call fcn.00414fd0
add esp, 0xc
mov eax, dword [str.qdfpzs.exe]
mov dword [ebp - 0xa34], eax
mov ecx, dword [0x42d8ec]
mov dword [ebp - 0xa30], ecx
mov dx, word [0x42d8f0]
mov word [ebp - 0xa2c], dx
mov al, byte [0x42d8f2]
mov byte [ebp - 0xa2a], al
push 0x75
push 0
lea eax, [ebp - 0xa29]
push eax
call fcn.00414fd0
add esp, 0xc
mov eax, dword [str.dppt_amixd.exe]
mov dword [ebp - 0xab4], eax
mov ecx, dword [0x42d8f8]
mov dword [ebp - 0xab0], ecx
mov edx, dword [0x42d8fc]
mov dword [ebp - 0xaac], edx
mov ax, word [0x42d900]
mov word [ebp - 0xaa8], ax
mov cl, byte [0x42d902]
mov byte [ebp - 0xaa6], cl
push 0x71
push 0
lea eax, [ebp - 0xaa5]
push eax
call fcn.00414fd0
add esp, 0xc
movzx eax, byte [0x43c3e5]
test eax, eax
jne 0x4113ac
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a34], esp
push 0x42d904
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
mov byte [ebp - 0x931], 0
lea eax, [ebp - 0x9b4]
push eax
call fcn.00408ff0
add esp, 4
movzx ecx, al
cmp ecx, 1
je 0x4101dc
lea eax, [ebp - 0xab4]
push eax
call fcn.00408ff0
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x41045e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1a30], esp
push str.cnewskfpd_debug_or_cnewskfp2022_debug
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0
push 0x408b50
call dword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [0x43c3e4]
test eax, eax
je 0x410452
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41030b
mov byte [ebp - 0xcac], 0
push 0x1f3
push 0
lea eax, [ebp - 0xcab]
push eax
call fcn.00414fd0
add esp, 0xc
mov byte [ebp - 0xcc0], 0
xor eax, eax
mov dword [ebp - 0xcbf], eax
mov dword [ebp - 0xcbb], eax
mov dword [ebp - 0xcb7], eax
mov dword [ebp - 0xcb3], eax
mov word [ebp - 0xcaf], ax
mov byte [ebp - 0xcad], al
push 0x104
lea eax, [ebp - 0xcac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.guide.ini
lea eax, [ebp - 0xcac]
push eax
call fcn.00406ef0
add esp, 8
lea eax, [ebp - 0xcac]
push eax
push 0x400
lea ecx, [ebp - 0xcc0]
push ecx
push 0
push 0x42d950
push str.KPRJV3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0xcc0]
test edx, edx
je 0x41030b
push 0xa
push 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040d0f0
add esp, 0xc
mov dword [ebp - 0xcc4], eax
push 0
mov eax, dword [ebp - 0xcc4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x196c], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x890]
call fcn.00408660
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
mov eax, dword [ebp - 0x196c]
jmp 0x4114e4
mov byte [ebp - 0x931], 1
jmp 0x4106f6
lea eax, [ebp - 0xa34]
push eax
call fcn.00408ff0
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x4106f6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1950], esp
push str.cnewskfp
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0
push 0x408b50
call dword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [0x43c3e4]
test eax, eax
je 0x4106ef
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4105a8
mov byte [ebp - 0xebc], 0
push 0x1f3
push 0
lea eax, [ebp - 0xebb]
push eax
call fcn.00414fd0
add esp, 0xc
mov byte [ebp - 0xed0], 0
xor eax, eax
mov dword [ebp - 0xecf], eax
mov dword [ebp - 0xecb], eax
mov dword [ebp - 0xec7], eax
mov dword [ebp - 0xec3], eax
mov word [ebp - 0xebf], ax
mov byte [ebp - 0xebd], al
push 0x104
lea eax, [ebp - 0xebc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.guide.ini
lea eax, [ebp - 0xebc]
push eax
call fcn.00406ef0
add esp, 8
lea eax, [ebp - 0xebc]
push eax
push 0x400
lea ecx, [ebp - 0xed0]
push ecx
push 0
push 0x42d950
push str.KPRJV3
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0xed0]
test edx, edx
je 0x4105a8
push 0xa
push 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040d0f0
add esp, 0xc
mov dword [ebp - 0xed4], eax
push 0
mov eax, dword [ebp - 0xed4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x194c], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x890]
call fcn.00408660
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
mov eax, dword [ebp - 0x194c]
jmp 0x4114e4
mov byte [ebp - 0x931], 1
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x410736
push 0xa
push 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040d0f0
add esp, 0xc
mov dword [ebp - 0xed8], eax
push 0
mov eax, dword [ebp - 0xed8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0xedc], 1
movzx eax, byte [ebp - 0x931]
test eax, eax
jne 0x410846
cmp dword [ebp - 0xedc], 3
jg 0x410846
mov byte [ebp - 0x10d0], 0
push 0x1f3
push 0
lea eax, [ebp - 0x10cf]
push eax
call fcn.00414fd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x10d0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea eax, [ebp - 0x10d0]
push eax
call fcn.0040d1c0
add esp, 8
mov ecx, 1
imul edx, ecx, 0
mov byte [eax + edx], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1948], esp
lea eax, [ebp - 0x10d0]
push eax
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 1
lea eax, [ebp - 0x10d0]
push eax
push 0
push str.qdfpzs.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xa34]
push eax
call fcn.00408ff0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x410832
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1944], esp
push 0x42d96c
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
jmp 0x410846
mov eax, dword [ebp - 0xedc]
add eax, 1
mov dword [ebp - 0xedc], eax
jmp 0x410740
push 0
call fcn.00411520
add esp, 4
push eax
call fcn.00416451
add esp, 4
mov dword [ebp - 0x10d4], 0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10d8], 0x64
mov byte [ebp - 0x10d9], 1
mov eax, dword [ebp - 0x10d8]
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x10d8]
sub ecx, 1
mov dword [ebp - 0x10d8], ecx
cmp dword [ebp - 0x1c24], 0
jle 0x4108de
push 0xffffffffffffffff
push str..Pipeqdfpzsmainpipe
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0
jne 0x4108d3
mov byte [ebp - 0x10d9], 0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4108dc
mov byte [ebp - 0x10d9], 1
jmp 0x4108de
jmp 0x41087f
movzx eax, byte [ebp - 0x10d9]
test eax, eax
jne 0x410a34
mov dword [ebp - 0x1940], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x890]
call fcn.00408660
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
mov eax, dword [ebp - 0x1940]
jmp 0x4114e4
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..Pipeqdfpzsmainpipe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10e4], eax
cmp dword [ebp - 0x10e4], 0xffffffff
jne 0x410a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10e8], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x193c], esp
push 0x42d994
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
jmp 0x410171
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1938], esp
push 0x42d9a8
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0x42d29c
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x410b17
push str.mainkp
lea ecx, [ebp - 0x1428]
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
mov edx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], edx
mov byte [ebp - 4], 0x62
mov eax, dword [ebp - 0x1444]
or eax, 1
mov dword [ebp - 0x1444], eax
mov ecx, dword [ebp - 0x1c28]
mov dword [ebp - 0x1c2c], ecx
jmp 0x410b50
lea edx, [ebp - 0x28]
push edx
push str.mainkp_
lea eax, [ebp - 0x1410]
push eax
call fcn.00406c80
add esp, 0xc
mov dword [ebp - 0x1c30], eax
mov ecx, dword [ebp - 0x1444]
or ecx, 2
mov dword [ebp - 0x1444], ecx
mov edx, dword [ebp - 0x1c30]
mov dword [ebp - 0x1c2c], edx
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1934], eax
mov ecx, dword [ebp - 0x1934]
push ecx
lea ecx, [ebp - 0x1100]
call fcn.00401e00
mov dword [ebp - 4], 0x63
mov edx, dword [ebp - 0x1444]
and edx, 2
je 0x410b92
and dword [ebp - 0x1444], 0xfffffffd
lea ecx, [ebp - 0x1410]
call fcn.00402160
mov byte [ebp - 4], 0x64
mov eax, dword [ebp - 0x1444]
and eax, 1
je 0x410bb3
and dword [ebp - 0x1444], 0xfffffffe
lea ecx, [ebp - 0x1428]
call fcn.00402160
push str.START_QFPT
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x410c7c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push str.mainkp_
lea edx, [ebp - 0x13f8]
push edx
call fcn.00406c80
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x65
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x13e0]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1100]
call fcn.00402230
lea ecx, [ebp - 0x13e0]
call fcn.00402160
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x13f8]
call fcn.00402160
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x1930], esp
push 0x42d9cc
lea ecx, [ebp - 0x1100]
push ecx
push eax
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
jmp 0x410e0c
push str.START_XN100
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x410d45
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x74]
push ecx
push str.mainkp_
lea edx, [ebp - 0x13c8]
push edx
call fcn.00406c80
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x13b0]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1100]
call fcn.00402230
lea ecx, [ebp - 0x13b0]
call fcn.00402160
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x13c8]
call fcn.00402160
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x192c], esp
push 0x42d9cc
lea ecx, [ebp - 0x1100]
push ecx
push eax
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
jmp 0x410e0c
push str.START_QD_ASSIST
lea eax, [ebp - 0x28]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x410e0c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push str.mainkp_
lea edx, [ebp - 0x1398]
push edx
call fcn.00406c80
add esp, 0xc
mov dword [ebp - 0x1c24], eax
mov eax, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], eax
mov byte [ebp - 4], 0x67
mov ecx, dword [ebp - 0x1c28]
push ecx
lea edx, [ebp - 0x1380]
push edx
call fcn.00401400
add esp, 0xc
mov dword [ebp - 0x1c2c], eax
mov eax, dword [ebp - 0x1c2c]
push eax
lea ecx, [ebp - 0x1100]
call fcn.00402230
lea ecx, [ebp - 0x1380]
call fcn.00402160
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x1398]
call fcn.00402160
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x1928], esp
push 0x42d9cc
lea ecx, [ebp - 0x1100]
push ecx
push eax
call fcn.00406bc0
add esp, 0xc
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0
lea eax, [ebp - 0x10d4]
push eax
lea ecx, [ebp - 0x1100]
call fcn.00406760
push eax
lea ecx, [ebp - 0x1100]
call fcn.004054f0
push eax
mov ecx, dword [ebp - 0x10e4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410e9e
mov eax, dword [ebp - 0x10e4]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebp - 0x10e4]
push eax
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x10e4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1924], esp
push 0x42d9d4
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1100]
call fcn.00402160
jmp 0x410171
mov al, byte [0x42d29c]
mov byte [ebp - 0x1200], al
push 0xff
push 0
lea eax, [ebp - 0x11ff]
push eax
call fcn.00414fd0
add esp, 0xc
mov dword [ebp - 0x1204], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1920], esp
push 0x42d9e8
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1100]
call fcn.00402160
mov eax, 1
test eax, eax
je 0x4113a7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x191c], esp
push 0x42d9fc
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
movzx eax, byte [ebp - 0x929]
test eax, eax
je 0x411081
mov dword [ebp - 0x1918], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x890]
call fcn.00408660
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
mov eax, dword [ebp - 0x1918]
jmp 0x4114e4
mov al, byte [0x42d29c]
mov byte [ebp - 0x1304], al
push 0xff
push 0
lea eax, [ebp - 0x1303]
push eax
call fcn.00414fd0
add esp, 0xc
mov dword [ebp - 0x1308], 0
push 0
lea eax, [ebp - 0x1308]
push eax
push 0x100
lea ecx, [ebp - 0x1304]
push ecx
mov edx, dword [ebp - 0x10e4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x1304]
push eax
lea ecx, [ebp - 0x1320]
call fcn.00401f00
mov byte [ebp - 4], 0x68
push str.MainRestart
lea eax, [ebp - 0x1320]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4112c4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1914], esp
push 0x42da18
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0x42d594
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1324], eax
cmp dword [ebp - 0x1324], 0
je 0x411178
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1910], esp
push 0x42da28
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x1324]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x42d57c
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1328], eax
cmp dword [ebp - 0x1328], 0
je 0x4111ca
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x190c], esp
push 0x42da38
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x1328]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18f0], esp
push 0x42da48
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push str.aisvr.exe
call fcn.00408ff0
add esp, 4
movzx eax, al
cmp eax, 1
jne 0x41120f
push 0
push str.taskkill__f__im_aisvr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_qdfpzs.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_skfpd.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
je 0x4112ab
lea eax, [ebp - 0xa34]
push eax
call fcn.00408ff0
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x411284
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18d4], esp
push 0x42da5c
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4112a9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1840], esp
push 0x42da70
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
jmp 0x4112ab
jmp 0x411234
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1320]
call fcn.00402160
jmp 0x4113a7
push str.MainClose
lea eax, [ebp - 0x1320]
push eax
call fcn.00401340
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x411388
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x180c], esp
push 0x42da98
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17f0], esp
push 0x42da48
call fcn.00401f00
mov dword [ebp - 0x1c24], eax
call fcn.00409550
add esp, 0x18
push str.aisvr.exe
call fcn.00408ff0
add esp, 4
movzx eax, al
cmp eax, 1
jne 0x41134b
push 0
push str.taskkill__f__im_aisvr.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_qdfpzs.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_dppt_amixd.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x43c3e5], 1
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1320]
call fcn.00402160
jmp 0x4113a7
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1320]
call fcn.00402160
jmp 0x410efb
jmp 0x410171
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x890]
call fcn.00408660
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1f4]
call fcn.00402160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc]
call fcn.00402160
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c4]
call fcn.00402160
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1ac]
call fcn.00402160
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x194]
call fcn.00402160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x17c]
call fcn.00402160
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
call fcn.00402160
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x14c]
call fcn.00402160
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x134]
call fcn.00402160
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c]
call fcn.00402160
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x104]
call fcn.00402160
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xec]
call fcn.00402160
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd4]
call fcn.00402160
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.00402160
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa4]
call fcn.00402160
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.00402160
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.00402160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00402160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402160
jmp 0x4114e2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412da9
mov esp, ebp
pop ebp
ret