Function at 0x427ce8
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
mov eax, 0x689218
push ebx
push esi
push edi
mov esi, 0x6add30
mov edi, dword [ebp + 0xc]
mov ebx, 0x67ca94
call fcn.00650394
mov word [ebp - 0x150], 0xc
mov edx, edi
mov eax, dword [ebp + 8]
call fcn.004423f0
test al, al
je 0x428161
mov word [ebp - 0x150], 0x24
xor edx, edx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
lea eax, [ebx + 0x167c]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x534
call fcn.0065ff98
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebx + 0x1685]
lea eax, [ebp - 0x20]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x20]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x24]
pop eax
call fcn.0065fbec
lea eax, [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x28]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x538
call fcn.0065fbec
lea eax, [ebp - 0x28]
push eax
lea edx, [ebx + 0x168f]
lea eax, [ebp - 0x2c]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x2c]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x30]
pop eax
call fcn.0065fbec
lea eax, [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x34]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x540
call fcn.0065fbec
lea eax, [ebp - 0x34]
push eax
lea edx, [ebx + 0x169b]
lea eax, [ebp - 0x38]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x38]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x3c]
pop eax
call fcn.0065fbec
lea eax, [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x40]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x540
call fcn.0065fbec
lea eax, [ebp - 0x40]
push eax
lea edx, [ebx + 0x16ae]
lea eax, [ebp - 0x44]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x44]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x48]
pop eax
call fcn.0065fbec
lea eax, [ebp - 0x48]
xor edx, edx
mov dword [ebp - 0x4c], edx
lea ecx, [ebp - 0x4c]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x544
call fcn.0065fbec
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebx + 0x16b7]
lea eax, [ebp - 0x50]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x50]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x54]
pop eax
call fcn.0065fbec
lea eax, [ebp - 0x54]
xor edx, edx
mov dword [ebp - 0x58], edx
lea ecx, [ebp - 0x58]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x242c
call fcn.0065fbec
lea eax, [ebp - 0x58]
push eax
lea edx, [ebx + 0x16c0]
lea eax, [ebp - 0x5c]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x5c]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x18]
pop eax
call fcn.0065fbec
dec dword [ebp - 0x144]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x18
push 1
xor ecx, ecx
mov word [ebp - 0x150], 0x30
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x60]
inc dword [ebp - 0x144]
lea edx, [ebp - 0x18]
lea eax, [ebx + 0x16c3]
call fcn.0065ff98
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebx + 0x16d6]
lea eax, [ebp - 0x64]
call fcn.0065fa0c
inc dword [ebp - 0x144]
xor eax, eax
mov dword [ebp - 0x68], eax
lea edx, [ebp - 0x64]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x68]
pop eax
call fcn.0065fbec
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
xor ecx, ecx
call fcn.0065de84
inc dword [ebp - 0x144]
lea edx, [ebp - 0x6c]
inc dword [ebp - 0x144]
mov dword [ebp - 0x164], edx
mov ecx, dword [ebp - 0x164]
cmp dword [ecx], 0
jne 0x4280dd
lea eax, [ebx + 0x16db]
jmp 0x4280e5
mov edx, dword [ebp - 0x164]
mov eax, dword [edx]
push eax
call sub.KERNEL32.DLL_WinExec
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040a464
dec dword [ebp - 0x144]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [0x6ae0a4]
mov eax, dword [ecx]
call fcn.005385bc
dec dword [ebp - 0x144]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0xc
mov ecx, dword [ebp + 8]
xor eax, eax
mov dx, 0xfff5
mov dword [ecx + 0x2440], eax
mov eax, dword [ebp + 8]
call fcn.005509d4
mov word [ebp - 0x150], 0x48
lea eax, [ebp - 4]
mov edx, edi
call fcn.0065fa4c
inc dword [ebp - 0x144]
lea eax, [ebp - 8]
mov word [ebp - 0x150], 0x3c
mov word [ebp - 0x150], 0x54
mov edx, dword [ebp + 0x10]
call fcn.0065fa4c
inc dword [ebp - 0x144]
lea eax, [ebp - 0xc]
mov word [ebp - 0x150], 0x3c
mov word [ebp - 0x150], 0x60
mov edx, dword [ebp + 0x14]
call fcn.0065fa4c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x16dc]
mov word [ebp - 0x150], 0x3c
mov word [ebp - 0x150], 0x6c
lea eax, [ebp - 0x10]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x16dd]
mov word [ebp - 0x150], 0x3c
mov word [ebp - 0x150], 0x78
lea eax, [ebp - 0x14]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0x70]
mov word [ebp - 0x150], 0x3c
mov edi, dword [ebp + 8]
mov ecx, edx
mov word [ebp - 0x150], 0x84
mov eax, dword [ebp + 0x18]
add edi, 0x4f8
xchg ecx, eax
xor edx, edx
xchg ecx, edx
call fcn.0065de84
inc dword [ebp - 0x144]
inc dword [ebp - 0x144]
lea edx, [ebp - 0x70]
mov eax, edi
call fcn.0065dfb4
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.0040a464
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x4a6], 1
mov ecx, dword [sym.WoTax.exe__newMainForm]
mov eax, dword [ecx]
cmp byte [eax + 0x445], 0
je 0x429529
mov word [ebp - 0x150], 0x90
xor edx, edx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], edx
push ecx
inc dword [ebp - 0x144]
lea edx, [ebx + 0x16e4]
lea eax, [ebp - 0x84]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x16df]
mov ecx, dword [eax]
lea eax, [ebp - 0x80]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
pop ecx
call fcn.0042133c
lea eax, [ebp - 0x88]
xor edx, edx
mov dword [ebp - 0x8c], edx
lea edx, [ebp - 0x8c]
inc dword [ebp - 0x144]
call fcn.0065fdd4
lea edx, [ebp - 0x8c]
xor eax, eax
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x90]
inc dword [ebp - 0x144]
mov eax, dword [ebp + 8]
add eax, 0x4cc
call fcn.0065fbec
lea edx, [ebp - 0x90]
mov edi, dword [ebp + 8]
add edi, 0x4c0
mov eax, edi
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x9c
xor ecx, ecx
lea edx, [ebx + 0x16ef]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
push ecx
lea eax, [ebp - 0x98]
inc dword [ebp - 0x144]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x16ea]
mov ecx, dword [eax]
lea eax, [ebp - 0x94]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
pop ecx
call fcn.0042133c
lea eax, [ebp - 0x9c]
xor edx, edx
mov dword [ebp - 0xa0], edx
lea edx, [ebp - 0xa0]
inc dword [ebp - 0x144]
call fcn.0065fdd4
lea edx, [ebp - 0xa0]
xor eax, eax
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0xa4]
inc dword [ebp - 0x144]
mov eax, dword [ebp + 8]
add eax, 0x4d0
call fcn.0065fbec
lea edx, [ebp - 0xa4]
mov eax, dword [ebp + 8]
add eax, 0x4c4
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xa4]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.0065fb9c
mov edx, edi
mov eax, dword [ebp + 8]
add eax, 0x4e0
call fcn.0065fbc4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xa8]
add ecx, 0x2438
mov dword [ebp - 0x168], ecx
xor ecx, ecx
mov word [ebp - 0x150], 0xa8
mov dword [ebp - 0xa8], ecx
push eax
inc dword [ebp - 0x144]
mov dword [ebp - 0x16c], edi
mov edx, dword [ebp - 0x16c]
cmp dword [edx], 0
je 0x428532
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ecx]
mov ecx, dword [eax - 4]
jmp 0x428534
xor ecx, ecx
add ecx, 0xfffffffa
mov eax, edi
mov edx, 8
call fcn.0065fe60
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0xac]
xor ecx, ecx
call fcn.0065de84
inc dword [ebp - 0x144]
lea eax, [ebp - 0xac]
inc dword [ebp - 0x144]
mov edx, eax
mov eax, dword [ebp - 0x168]
call fcn.0065dfb4
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0xac]
mov edx, 2
call fcn.0040a464
dec dword [ebp - 0x144]
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x4285b5
call fcn.004d8320
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx], ecx
mov word [ebp - 0x150], 0xb4
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x74], ecx
lea edx, [ebx + 0x16f5]
inc dword [ebp - 0x144]
mov word [ebp - 0x150], 0xc0
mov word [ebp - 0x150], 0xcc
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0xb0]
inc dword [ebp - 0x144]
mov word [ebp - 0x150], 0xc0
mov word [ebp - 0x150], 0xd8
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xb0]
mov eax, dword [ebp + 8]
add eax, 0x494
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0xe4
lea edx, [ebx + 0x16f9]
lea eax, [ebp - 0xb4]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xb4]
mov edi, dword [ebp + 8]
add edi, 0x498
mov eax, edi
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xb4]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xb8]
mov edx, dword [ebp - 0x14]
push edx
lea edx, [ebx + 0x173c]
mov word [ebp - 0x150], 0xf0
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x173e]
mov ecx, dword [eax]
lea eax, [ebp - 0xbc]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov ecx, dword [eax]
push ecx
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
inc dword [ebp - 0x144]
lea edx, [ebp - 0xc0]
inc dword [ebp - 0x144]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4f8]
call fcn.0040a2e0
lea edx, [ebp - 0xc0]
mov ecx, dword [edx]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2438]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0044e428
xor edx, edx
mov dl, al
lea eax, [ebp - 0xc0]
cmp edx, 1
mov edx, 2
sbb ecx, ecx
neg ecx
push ecx
sub dword [ebp - 0x144], 2
call fcn.0040a464
dec dword [ebp - 0x144]
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xb8]
mov edx, 2
call fcn.0065fb9c
pop ecx
test cl, cl
je 0x4288e2
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x428781
call fcn.004d8320
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx], ecx
mov word [ebp - 0x150], 0xfc
lea edx, [ebx + 0x1740]
lea eax, [ebp - 0xc4]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xc4]
mov eax, dword [ebp + 8]
add eax, 0x494
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x108
lea edx, [ebx + 0x1744]
lea eax, [ebp - 0xc8]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xc8]
mov eax, edi
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xc8]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0x14]
push edx
lea edx, [ebx + 0x178d]
mov word [ebp - 0x150], 0x114
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x178f]
mov ecx, dword [eax]
lea eax, [ebp - 0xd0]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov ecx, dword [eax]
push ecx
xor ecx, ecx
mov dword [ebp - 0xd4], ecx
inc dword [ebp - 0x144]
lea edx, [ebp - 0xd4]
inc dword [ebp - 0x144]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4f8]
call fcn.0040a2e0
lea edx, [ebp - 0xd4]
mov ecx, dword [edx]
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2438]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0044e428
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.0040a464
dec dword [ebp - 0x144]
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x120
lea edx, [ebx + 0x1791]
lea eax, [ebp - 0x7c]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x1792]
mov word [ebp - 0x150], 0xc0
mov word [ebp - 0x150], 0x12c
lea eax, [ebp - 0xd8]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp + 8]
add eax, 0x494
call fcn.0065fc70
push eax
dec dword [ebp - 0x144]
lea eax, [ebp - 0xd8]
mov edx, 2
call fcn.0065fb9c
pop ecx
test cl, cl
je 0x429391
mov word [ebp - 0x150], 0x138
xor ecx, ecx
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], ecx
xor edx, edx
inc dword [ebp - 0x144]
push eax
inc dword [ebp - 0x144]
mov dword [ebp - 0xe4], edx
inc dword [ebp - 0x144]
inc dword [ebp - 0x144]
lea edx, [ebp - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4f8]
call fcn.0040a2e0
lea edx, [ebp - 0xe4]
mov ecx, dword [edx]
push ecx
mov dword [ebp - 0x170], edi
lea eax, [ebp - 0xe0]
xor ecx, ecx
mov edx, dword [ebp - 0x170]
call fcn.0065de84
inc dword [ebp - 0x144]
lea ecx, [ebp - 0xe0]
inc dword [ebp - 0x144]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
pop ecx
call fcn.00422648
xor eax, eax
mov dword [ebp - 0xec], eax
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xec]
call fcn.004765ac
inc dword [ebp - 0x144]
lea edx, [ebp - 0xec]
lea eax, [ebp - 0x7c]
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0xec]
mov edx, 2
call fcn.0065fb9c
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0xe8]
mov edx, 2
call fcn.0040a464
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0xe4]
mov edx, 2
call fcn.0040a464
sub dword [ebp - 0x144], 2
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.0040a464
mov word [ebp - 0x150], 0x144
lea edx, [ebx + 0x1794]
lea eax, [ebp - 0xf0]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0x7c]
call fcn.0065fd3c
push eax
dec dword [ebp - 0x144]
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.0065fb9c
pop ecx
test ecx, ecx
je 0x428b0b
mov word [ebp - 0x150], 0x150
lea edx, [ebx + 0x1796]
lea eax, [ebp - 0xf4]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0x7c]
call fcn.0065fd3c
mov edx, eax
lea eax, [ebp - 0x7c]
mov ecx, 1
call fcn.0065fd14
dec dword [ebp - 0x144]
lea eax, [ebp - 0xf4]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x168
lea edx, [ebx + 0x1798]
lea eax, [ebp - 0xdc]
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov word [ebp - 0x150], 0x15c
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x7c]
push edx
lea edx, [ebp - 0xdc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4ac]
push eax
push edx
mov ecx, dword [ebp - 0x14]
lea edx, [ebx + 0x1799]
push ecx
lea eax, [ebp - 0xf8]
mov word [ebp - 0x150], 0x174
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x179b]
mov ecx, dword [eax]
lea eax, [ebp - 0xfc]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebx + 0x179f]
mov ecx, dword [eax]
lea eax, [ebp - 0x100]
push ecx
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov ecx, dword [eax]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x2438]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.0044f1a0
xor edx, edx
mov dl, al
lea eax, [ebp - 0x100]
cmp edx, 1
mov edx, 2
sbb ecx, ecx
neg ecx
push ecx
dec dword [ebp - 0x144]
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xfc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xf8]
mov edx, 2
call fcn.0065fb9c
pop ecx
test cl, cl
je 0x428f49
mov word [ebp - 0x150], 0x180
lea edx, [ebx + 0x17a1]
lea eax, [ebp - 0x10c]
call fcn.0065fa0c
inc dword [ebp - 0x144]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
call fcn.00421160
dec dword [ebp - 0x144]
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0065fb9c
mov esi, edi
lea ecx, [ebx + 0x17c6]
push 0
push ecx
cmp dword [esi], 0
je 0x428c6f
mov ecx, dword [esi]
jmp 0x428c75
lea ecx, [ebx + 0x17cc]
push ecx
mov eax, dword [ebp + 8]
call fcn.0055975c
push eax
call sub.USER32.DLL_MessageBoxW
push 0
lea edx, [ebx + 0x17e6]
push edx
lea ecx, [ebx + 0x17ce]
push ecx
mov eax, dword [ebp + 8]
call fcn.0055975c
push eax
call sub.USER32.DLL_MessageBoxW
mov word [ebp - 0x150], 0x198
lea edx, [ebx + 0x17ec]
lea eax, [ebp - 0x104]
call fcn.0065fb38
inc dword [ebp - 0x144]
xor edx, edx
mov word [ebp - 0x150], 0x18c
mov word [ebp - 0x150], 0x1a4
mov dword [ebp - 0x108], edx
lea edx, [ebp - 0x104]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0065fbec
mov word [ebp - 0x150], 0x18c
cmp dword [ebp - 0x108], 0
je 0x428d13
mov ecx, dword [ebp - 0x108]
jmp 0x428d19
lea ecx, [ebx + 0x17fa]
push ecx
lea ecx, [ebx + 0x17f0]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x474]
mov eax, dword [ebp + 8]
call fcn.004318e8
lea ecx, [ebx + 0x17fc]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x474]
mov eax, dword [ebp + 8]
call fcn.0043ea8c
mov ecx, dword [sym.WoTax.exe__newMainForm]
mov eax, dword [ecx]
test eax, eax
je 0x428d5b
mov byte [eax + 0x47c], 0
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0x108]
dec dword [ebp - 0x144]
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x104]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0065fb9c
pop eax
push eax
xor edx, edx
mov dword [ebp - 0x144], edx
lea ecx, [ebp - 0x160]
push ecx
call fcn.0065d4b0
pop ecx
pop eax
jmp 0x4296cb
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x4a4], 0
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x428f66
call fcn.004d8320
mov edx, dword [esi]
xor ecx, ecx
mov dword [edx], ecx
mov ecx, dword [0x6ae0a4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x6996e8]
call fcn.004655b0
mov edi, eax
mov eax, dword [esi]
mov dword [eax], edi
lea edx, [ebp - 0xdc]
mov eax, edi
add eax, 0x424
call fcn.0065fbc4
mov edx, dword [sym.WoTax.exe__newMainForm]
mov eax, dword [esi]
mov ecx, dword [edx]
mov dl, byte [ecx + 0x445]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3bc]
call fcn.005506a0
mov edx, dword [sym.WoTax.exe__newMainForm]
mov eax, dword [esi]
mov ecx, dword [edx]
xor edx, edx
mov dl, byte [ecx + 0x445]
mov ecx, dword [eax]
cmp edx, 1
sbb edx, edx
mov eax, dword [ecx + 0x3c0]
neg edx
call fcn.005506a0
mov edx, dword [esi]
mov ecx, dword [edx]
xor edx, edx
mov eax, dword [ecx + 0x3e4]
call fcn.005506a0
mov ecx, dword [esi]
mov dl, 1
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x3e0]
call fcn.005506a0
mov word [ebp - 0x150], 0x1b0
lea edx, [ebx + 0x180e]
lea eax, [ebp - 0x110]
call fcn.0065fa0c
mov edx, eax
inc dword [ebp - 0x144]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3e0]
add eax, 0x80
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [sym.WoTax.exe__newMainForm]
mov edi, dword [ecx]
cmp byte [edi + 0x445], 0
je 0x429145
mov word [ebp - 0x150], 0x1bc
lea edx, [ebx + 0x1819]
lea eax, [ebp - 0x114]
call fcn.0065fa0c
inc dword [ebp - 0x144]
lea edx, [ebp - 0x114]
mov eax, edi
add eax, 0x450
call fcn.0065fd3c
push eax
dec dword [ebp - 0x144]
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0065fb9c
pop ecx
test ecx, ecx
je 0x4290f7
mov word [ebp - 0x150], 0x1c8
lea edx, [ebx + 0x1820]
lea eax, [ebp - 0x118]
call fcn.0065fa0c
mov edx, eax
inc dword [ebp - 0x144]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3bc]
add eax, 0x80
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.0065fb9c
jmp 0x429191
mov word [ebp - 0x150], 0x1d4
lea edx, [ebx + 0x1838]
lea eax, [ebp - 0x11c]
call fcn.0065fa0c
mov edx, eax
inc dword [ebp - 0x144]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3bc]
add eax, 0x80
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.0065fb9c
jmp 0x429191
mov word [ebp - 0x150], 0x1e0
lea edx, [ebx + 0x1850]
lea eax, [ebp - 0x120]
call fcn.0065fa0c
mov edx, eax
inc dword [ebp - 0x144]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c0]
add eax, 0x80
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [esi]
xor edx, edx
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x39c]
call fcn.004e6a74
mov ecx, dword [esi]
mov edi, dword [ecx]
mov eax, dword [edi + 0x39c]
call fcn.004e6a68
mov ecx, eax
mov eax, dword [edi + 0x40c]
mov edx, 6
call fcn.004ec108
mov word [ebp - 0x150], 0x1ec
lea edx, [ebx + 0x185b]
lea eax, [ebp - 0x124]
call fcn.0065fa0c
mov edx, eax
inc dword [ebp - 0x144]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x39c]
add eax, 0x80
call fcn.0065fbc4
dec dword [ebp - 0x144]
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x39c]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov word [ebp - 0x150], 0x1f8
xor eax, eax
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x128], eax
lea eax, [ebx + 0x186c]
inc dword [ebp - 0x144]
mov edx, dword [ebp + 8]
add edx, 0x520
call fcn.0065ff98
mov eax, dword [esi]
lea edx, [ebp - 0x128]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [ecx + 0x3b8]
call fcn.005507b8
dec dword [ebp - 0x144]
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.0065fb9c
mov ecx, dword [esi]
mov eax, dword [ecx]
call fcn.005339a4
mov edx, dword [sym.WoTax.exe__newMainForm]
mov eax, dword [edx]
test eax, eax
je 0x42929a
mov byte [eax + 0x47c], 1
mov eax, dword [ebp + 8]
call fcn.005500ac
mov edx, dword [ebp + 8]
mov dword [edx + 0x4a0], eax
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0052eb4c
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xdc]
dec dword [ebp - 0x144]
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0065fb9c
pop eax
push eax
xor edx, edx
mov dword [ebp - 0x144], edx
lea ecx, [ebp - 0x160]
push ecx
call fcn.0065d4b0
pop ecx
pop eax
jmp 0x4296cb
lea edx, [ebx + 0x1896]
push 0x40
push edx
xor ecx, ecx
mov word [ebp - 0x150], 0x204
mov dword [ebp - 0x134], ecx
lea ecx, [ebp - 0x134]
inc dword [ebp - 0x144]
lea eax, [ebx + 0x1877]
mov edx, dword [ebp + 8]
add edx, 0x498
call fcn.0065ff98
cmp dword [ebp - 0x134], 0
je 0x4293dc
mov ecx, dword [ebp - 0x134]
jmp 0x4293e2
lea ecx, [ebx + 0x18a0]
push ecx
mov eax, dword [ebp + 8]
call fcn.0055975c
push eax
call sub.USER32.DLL_MessageBoxW
dec dword [ebp - 0x144]
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x21c
lea edx, [ebx + 0x18a2]
lea eax, [ebp - 0x12c]
call fcn.0065fb38
inc dword [ebp - 0x144]
xor ecx, ecx
mov word [ebp - 0x150], 0x210
mov word [ebp - 0x150], 0x228
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x130]
inc dword [ebp - 0x144]
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x12c]
call fcn.0065fbec
mov word [ebp - 0x150], 0x210
cmp dword [ebp - 0x130], 0
je 0x429478
mov ecx, dword [ebp - 0x130]
jmp 0x42947e
lea ecx, [ebx + 0x18b0]
push ecx
lea ecx, [ebx + 0x18a6]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x474]
mov eax, dword [ebp + 8]
call fcn.004318e8
lea ecx, [ebx + 0x18b2]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x474]
mov eax, dword [ebp + 8]
call fcn.0043ea8c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0xc0
dec dword [ebp - 0x144]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x3c
jmp 0x42962c
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x4e4], 0
push 0x40
lea ecx, [ebx + 0x1920]
push ecx
lea eax, [ebx + 0x18c4]
push eax
mov eax, dword [ebp + 8]
call fcn.0055975c
push eax
call sub.USER32.DLL_MessageBoxW
mov word [ebp - 0x150], 0x240
lea edx, [ebx + 0x192e]
lea eax, [ebp - 0x138]
call fcn.0065fb38
inc dword [ebp - 0x144]
xor edx, edx
mov word [ebp - 0x150], 0x234
mov word [ebp - 0x150], 0x24c
mov dword [ebp - 0x13c], edx
lea edx, [ebp - 0x138]
inc dword [ebp - 0x144]
lea ecx, [ebp - 0x13c]
lea eax, [ebp - 0x138]
call fcn.0065fbec
mov word [ebp - 0x150], 0x234
cmp dword [ebp - 0x13c], 0
je 0x4295c2
mov ecx, dword [ebp - 0x13c]
jmp 0x4295c8
lea ecx, [ebx + 0x193c]
push ecx
lea ecx, [ebx + 0x1932]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x474]
mov eax, dword [ebp + 8]
call fcn.004318e8
lea ecx, [ebx + 0x193e]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x474]
mov eax, dword [ebp + 8]
call fcn.0043ea8c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x13c]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0x3c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0065fb9c
dec dword [ebp - 0x144]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0065fb9c
mov word [ebp - 0x150], 0xc
mov word [ebp - 0x150], 0
mov ecx, dword [ebp + 8]
xor edx, edx
mov byte [ecx + 0x48c], 0
mov eax, dword [ebp + 8]
call fcn.005509d4
cmp word [ebp - 0x14e], 0
je 0x4296bc
ret
xor eax, eax
mov edx, dword [ebp - 0x160]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x17c]
mov esi, dword [ebp - 0x178]
mov ebx, dword [ebp - 0x174]
pop ebp
ret