Function at 0x65131c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x651324
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409650
lea eax, [ebp - 0x20]
mov edx, dword [0x651280]
call fcn.0040a96c
mov ebx, 0x686958
xor eax, eax
push ebp
push 0x65246c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x652480]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x652490
mov edx, 0x6524a4
mov eax, dword [ebp - 4]
call fcn.0042b824
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 7
jne 0x6523d7
lea ecx, [ebp - 0x30]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
mov ecx, 1
mov eax, 0x6524b8
call fcn.0040a710
test eax, eax
jle 0x6513c6
cmp byte [0x686902], 0
jne 0x6523d7
lea ecx, [ebp - 0x34]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x34]
mov ecx, 1
mov eax, 0x6524cc
call fcn.0040a710
test eax, eax
jle 0x6513f8
cmp byte [0x686902], 0
je 0x6523d7
lea ecx, [ebp - 0x3c]
mov edx, 3
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0042282c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00409994
mov eax, esi
dec ax
je 0x651435
dec ax
je 0x65144a
dec ax
je 0x65145f
dec ax
je 0x651474
jmp 0x651487
mov eax, dword [ebp - 0x18]
mov edx, 0x6524e0
call fcn.0040a4c8
jne 0x6523d7
jmp 0x651487
mov eax, dword [ebp - 0x18]
mov edx, 0x652514
call fcn.0040a4c8
jne 0x6523d7
jmp 0x651487
mov eax, dword [ebp - 0x18]
mov edx, 0x652558
call fcn.0040a4c8
jne 0x6523d7
jmp 0x651487
mov eax, dword [ebp - 0x18]
mov edx, 0x652594
call fcn.0040a4c8
jne 0x6523d7
cmp si, 5
jne 0x6514d3
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0042282c
mov edx, dword [ebp - 0x40]
mov ecx, 1
mov eax, 0x6525c8
call fcn.0040a710
test eax, eax
jle 0x6514d3
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x20]
call fcn.00409994
jmp 0x6514f5
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00646cac
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
call fcn.00409994
cmp si, 5
jne 0x6515a8
lea ecx, [ebp - 0x58]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0042282c
mov edx, dword [ebp - 0x54]
mov ecx, 1
mov eax, 0x6525ec
call fcn.0040a710
test eax, eax
jle 0x6515a8
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x652604]
push eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x652614
mov edx, 0x652630
mov eax, dword [ebp - 8]
call fcn.0042b824
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.00646cac
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 8]
call fcn.00409994
movzx eax, byte [0x652604]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x652654
mov edx, 0x652678
mov eax, dword [ebp - 8]
call fcn.0042b824
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x1c]
call fcn.00409994
jmp 0x6515cd
lea ecx, [ebp - 0x6c]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.00646cac
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x1c]
call fcn.00409994
cmp si, 5
jne 0x651775
mov eax, dword [ebp - 0x18]
mov edx, 0x652694
call fcn.0040a4c8
jne 0x651650
push dword [ebp - 0x20]
push 0x6526cc
push dword [ebp - 0x1c]
push 0x6526e0
lea ecx, [ebp - 0x74]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x74]
push 0x6526f4
lea ecx, [ebp - 0x78]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x78]
push 0x652708
lea ecx, [ebp - 0x7c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x70]
mov eax, 0x65271c
call fcn.00648d9c
mov eax, dword [ebp - 0x18]
mov edx, 0x652754
call fcn.0040a4c8
jne 0x6516db
push dword [ebp - 0x20]
push 0x65278c
push dword [ebp - 0x1c]
push 0x6527a0
lea ecx, [ebp - 0x84]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x84]
push 0x6527b4
lea ecx, [ebp - 0x88]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x88]
push 0x6527c8
lea ecx, [ebp - 0x8c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x8c]
lea eax, [ebp - 0x80]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x80]
mov eax, 0x6527dc
call fcn.00648d9c
mov eax, dword [ebp - 0x18]
mov edx, 0x652810
call fcn.0040a4c8
jne 0x6523d7
push dword [ebp - 0x20]
push 0x652848
push dword [ebp - 0x1c]
push 0x65285c
lea ecx, [ebp - 0x94]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x94]
push 0x652870
lea ecx, [ebp - 0x98]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x98]
push 0x652884
lea ecx, [ebp - 0x9c]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x90]
mov eax, 0x652898
call fcn.00648d9c
jmp 0x6523d7
lea ecx, [ebp - 0xa4]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0042282c
mov ecx, dword [ebp - 0xa0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
mov word [ebp - 0x14], 1
lea ecx, [ebp - 0xa8]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa8]
mov edx, 0x6528cc
call fcn.0040a4c8
jne 0x6517dc
mov word [ebp - 0x14], 3
jmp 0x651832
lea ecx, [ebp - 0xac]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xac]
mov edx, 0x6528ec
call fcn.0040a4c8
jne 0x651808
mov word [ebp - 0x14], 2
jmp 0x651832
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb0]
mov edx, 0x65290c
call fcn.0040a4c8
jne 0x651832
mov word [ebp - 0x14], 0
lea ecx, [ebp - 0xb8]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.0042282c
mov ecx, dword [ebp - 0xb4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xbc]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xbc]
mov edx, 0x652924
call fcn.0040a4c8
je 0x6518b3
lea ecx, [ebp - 0xc0]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc0]
mov edx, 0x652938
call fcn.0040a4c8
je 0x6518b3
xor eax, eax
jmp 0x6518b5
mov al, 1
mov byte [ebp - 0x12], al
lea ecx, [ebp - 0xc8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.0042282c
mov ecx, dword [ebp - 0xc4]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xcc]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xcc]
mov edx, 0x652948
call fcn.0040a4c8
je 0x651939
lea ecx, [ebp - 0xd0]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xd0]
mov edx, 0x65295c
call fcn.0040a4c8
je 0x651939
xor eax, eax
jmp 0x65193b
mov al, 1
mov byte [ebp - 0x11], al
mov byte [0x686903], 0
mov byte [0x686906], 0
mov esi, dword [ebp - 0x20]
mov eax, esi
test eax, eax
je 0x65195a
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x651d5b
lea eax, [ebp - 0xd8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040a500
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.0042282c
mov eax, dword [ebp - 0xd4]
mov edx, 0x65296c
call fcn.0040a4c8
jne 0x651d5b
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x652980
call fcn.0040a710
test eax, eax
jle 0x651d5b
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x652990
call fcn.0040a710
test eax, eax
jle 0x651d5b
mov ebx, esi
test ebx, ebx
je 0x6519e2
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x6529a0
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
mov ebx, esi
test ebx, ebx
je 0x651a29
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x6529b0
call fcn.0040a710
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 8]
call fcn.00646cac
mov edx, dword [ebp - 0xdc]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0xc]
call fcn.00646cac
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0xc]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a4c8
jne 0x6523d7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x651aa1
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jle 0x6523d7
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409994
lea eax, [ebp - 0xe8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.0042282c
mov eax, dword [ebp - 0xe4]
mov edx, 0x6529c0
call fcn.0040a4c8
je 0x651b6d
lea eax, [ebp - 0xf0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.0042282c
mov eax, dword [ebp - 0xec]
mov edx, 0x6529d8
call fcn.0040a4c8
je 0x651b6d
lea eax, [ebp - 0xf8]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.0042282c
mov eax, dword [ebp - 0xf4]
mov edx, 0x6529f0
call fcn.0040a4c8
jne 0x6523d7
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x652a08
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.0040a548
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x651b9a
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x10]
call fcn.00646cac
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x10]
call fcn.00409994
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.0042282c
mov eax, dword [ebp - 0x100]
mov edx, 0x652a18
call fcn.0040a4c8
jne 0x651c44
cmp byte [0x6868fa], 0
jne 0x651c44
push 0x40040
lea edx, [ebp - 0x108]
mov eax, dword [0x6868b0]
call fcn.00541938
mov eax, dword [ebp - 0x108]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x68056c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0042282c
mov eax, dword [ebp - 0x10c]
mov edx, 0x652a28
call fcn.0040a4c8
jne 0x651ccb
cmp dword [ebp - 0x10], 0
je 0x651cc4
cmp byte [0x6868fa], 0
jne 0x651cc4
push 0x40030
lea edx, [ebp - 0x114]
mov eax, dword [0x6868b0]
call fcn.00541938
mov eax, dword [ebp - 0x114]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x68056c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x686903], 1
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0042282c
mov eax, dword [ebp - 0x118]
mov edx, 0x652a38
call fcn.0040a4c8
jne 0x6523d7
cmp dword [ebp - 0x10], 0
je 0x651d4f
cmp byte [0x6868fa], 0
jne 0x651d4f
push 0x40030
lea edx, [ebp - 0x120]
mov eax, dword [0x6868b0]
call fcn.00541938
mov eax, dword [ebp - 0x120]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x68056c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x686906], 1
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652a48
jne 0x651d69
mov al, 1
jmp 0x651d8e
cmp dword [ebp - 0x20], 0
je 0x651d78
mov eax, 0x652a64
test eax, eax
jne 0x651d7c
xor eax, eax
jmp 0x651d8e
mov edx, 0x652a80
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x651ebf
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x652a9c
call fcn.0040a710
test eax, eax
jle 0x651dd8
movzx eax, byte [0x652480]
push eax
lea eax, [ebp - 0x124]
push eax
xor ecx, ecx
mov edx, 0x652aac
mov eax, dword [ebp - 0x1c]
call fcn.0042b824
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f8
test al, al
je 0x6523d7
mov byte [ebp - 0x25], 0
mov dl, 1
mov eax, dword [0x48fec4]
call fcn.004b3874
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x651e7c
inc ebx
xor esi, esi
lea ecx, [ebp - 0x128]
mov edx, esi
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x128]
mov ecx, 1
mov eax, 0x652abc
call fcn.0040a710
test eax, eax
jle 0x651e78
mov byte [ebp - 0x25], 1
lea ecx, [ebp - 0x130]
mov edx, esi
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00646cac
mov ecx, dword [ebp - 0x12c]
mov edx, esi
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0x20]
inc esi
dec ebx
jne 0x651e1a
cmp byte [ebp - 0x25], 0
je 0x651eb2
xor eax, eax
push ebp
push 0x651ea8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651eb2
mov eax, dword [ebp - 0x24]
call fcn.004078f0
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652acc
jne 0x651ecd
mov al, 1
jmp 0x651ef2
cmp dword [ebp - 0x20], 0
je 0x651edc
mov eax, 0x652af4
test eax, eax
jne 0x651ee0
xor eax, eax
jmp 0x651ef2
mov edx, 0x652b1c
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x651f09
cmp dword [ebp - 0x1c], 0
je 0x651f09
mov eax, dword [ebp - 0x1c]
call fcn.00424e08
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652b44
jne 0x651f17
mov al, 1
jmp 0x651f3c
cmp dword [ebp - 0x20], 0
je 0x651f26
mov eax, 0x652b64
test eax, eax
jne 0x651f2a
xor eax, eax
jmp 0x651f3c
mov edx, 0x652b84
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x651fb9
cmp byte [0x686902], 0
je 0x651fb9
xor eax, eax
push ebp
push 0x651faa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x686984], eax
push 0x652b98
push 0x652bd8
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00411f08
mov dword [0x68697c], eax
push 0x652bf4
push 0x652bd8
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00411f08
mov dword [0x686980], eax
push 0x686984
call dword [0x68697c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652c3c
jne 0x651fc7
mov al, 1
jmp 0x651fec
cmp dword [ebp - 0x20], 0
je 0x651fd6
mov eax, 0x652c58
test eax, eax
jne 0x651fda
xor eax, eax
jmp 0x651fec
mov edx, 0x652c74
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x65202f
cmp byte [0x686902], 0
je 0x65202f
xor eax, eax
push ebp
push 0x652020
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x686984]
push eax
call dword [0x686980]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652c90
jne 0x65203d
mov al, 1
jmp 0x652062
cmp dword [ebp - 0x20], 0
je 0x65204c
mov eax, 0x652cb8
test eax, eax
jne 0x652050
xor eax, eax
jmp 0x652062
mov edx, 0x652ce0
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x652107
mov eax, dword [0x686950]
mov edx, dword [eax]
call dword [edx + 0x48]
mov eax, dword [0x6868b0]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x652d08
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x6868b0]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax]
call dword [edx + 0x120]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x6523d7
inc ebx
xor esi, esi
push 0
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x138]
mov eax, dword [0x6868b0]
mov eax, dword [eax + 0x3b0]
mov eax, dword [eax + 0x2a0]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x138]
mov edx, 0x652d28
mov eax, dword [0x6868ec]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0x134]
mov dl, 1
call fcn.00649140
inc esi
dec ebx
jne 0x6520b5
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x652113
sub eax, 4
mov eax, dword [eax]
cmp eax, 7
jle 0x65222c
lea eax, [ebp - 0x13c]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0x20]
call fcn.0042282c
mov eax, dword [ebp - 0x140]
mov ecx, 6
mov edx, 1
call fcn.0040a500
mov eax, dword [ebp - 0x13c]
mov edx, 0x652d48
call fcn.0040a4c8
jne 0x65222c
cmp dword [ebp - 0x1c], 0
je 0x65222c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.00409994
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.0040a548
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x652191
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
cmp word [ecx + eax*2 - 2], 0x29
jne 0x6521b5
mov eax, edx
test eax, eax
je 0x6521a7
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 8]
mov ecx, 1
xchg edx, eax
call fcn.0040a548
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 8]
call fcn.00646cac
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.00409994
push 0x40024
lea edx, [ebp - 0x148]
mov eax, dword [0x6868b0]
call fcn.00541938
mov eax, dword [ebp - 0x148]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 8]
call fcn.0040a13c
push eax
mov eax, dword [0x68056c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x6523d7
push 0
xor ecx, ecx
movzx edx, byte [ebp - 0x12]
mov eax, dword [ebp - 0x1c]
call fcn.00650d84
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652d64
jne 0x65223a
mov al, 1
jmp 0x65225f
cmp dword [ebp - 0x20], 0
je 0x652249
mov eax, 0x652d98
test eax, eax
jne 0x65224d
xor eax, eax
jmp 0x65225f
mov edx, 0x652dcc
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x652278
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652e00
jne 0x652286
mov al, 1
jmp 0x6522ab
cmp dword [ebp - 0x20], 0
je 0x652295
mov eax, 0x652e38
test eax, eax
jne 0x652299
xor eax, eax
jmp 0x6522ab
mov edx, 0x652e70
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x6522c1
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652ea8
jne 0x6522cf
mov al, 1
jmp 0x6522f4
cmp dword [ebp - 0x20], 0
je 0x6522de
mov eax, 0x652ed0
test eax, eax
jne 0x6522e2
xor eax, eax
jmp 0x6522f4
mov edx, 0x652ef8
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x65230d
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x6523d7
mov eax, dword [ebp - 0x20]
cmp eax, 0x652f20
jne 0x65231b
mov al, 1
jmp 0x652340
cmp dword [ebp - 0x20], 0
je 0x65232a
mov eax, 0x652f50
test eax, eax
jne 0x65232e
xor eax, eax
jmp 0x652340
mov edx, 0x652f80
mov eax, dword [ebp - 0x20]
call fcn.004229cc
test eax, eax
sete al
test al, al
je 0x652384
xor eax, eax
push ebp
push 0x652378
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1388
push 2
push 0x652fa4
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6523d7
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.004241f8
test al, al
je 0x6523b0
movzx eax, word [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.0064f30c
jmp 0x6523cb
movzx eax, word [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040a13c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652476
lea eax, [ebp - 0x148]
call fcn.0040956c
lea eax, [ebp - 0x144]
mov edx, 9
call fcn.004095cc
lea eax, [ebp - 0x120]
call fcn.0040956c
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x114]
call fcn.0040956c
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x108]
call fcn.0040956c
lea eax, [ebp - 0x104]
mov edx, 0x37
call fcn.004095cc
lea eax, [ebp - 0x20]
mov edx, dword [0x651280]
call fcn.0040aa44
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004095cc
ret