Function at 0x64f42c
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x275
push 0
push 0
dec ecx
jne 0x64f434
push ebx
push esi
push edi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
mov edx, dword [0x64f2a0]
call fcn.0040a96c
lea eax, [ebp - 0x4a]
mov edx, dword [0x621058]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x6525e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48feb4]
call fcn.004b3864
mov dword [0x67e930], eax
mov byte [0x67e8e9], 0
mov byte [0x67e8e8], 0
lea edx, [ebp - 0x1090]
mov eax, dword [ebp - 0x50]
mov ebx, dword [eax + 0x420]
mov eax, ebx
call fcn.00541928
mov eax, dword [ebp - 0x1090]
lea edx, [ebp - 0x108c]
call fcn.00422c28
mov eax, dword [ebp - 0x108c]
lea edx, [ebp - 0x1088]
call fcn.0042b5e4
mov edx, dword [ebp - 0x1088]
mov eax, ebx
call fcn.0054197c
push 0
lea eax, [ebp - 0x1098]
push eax
mov ecx, 0x652604
mov edx, 0x652630
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1098]
lea edx, [ebp - 0x1094]
call fcn.00642f7c
mov edx, dword [ebp - 0x1094]
mov eax, 0x67e8fc
call fcn.0040994c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
xor edx, edx
call fcn.00577354
push 0x652648
lea eax, [ebp - 0x109c]
push eax
mov ecx, 0x652670
mov edx, 0x652684
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x109c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
push 0
mov ecx, 0x6526a0
mov edx, 0x6526c8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov byte [0x67e8ec], al
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
xor eax, eax
mov dword [0x67e944], eax
xor eax, eax
mov dword [0x67e948], eax
xor eax, eax
mov dword [0x67e94c], eax
xor eax, eax
mov dword [0x67e950], eax
xor eax, eax
mov dword [0x67e954], eax
cmp byte [0x67e8ed], 0
je 0x64f757
lea edx, [ebp - 0x10a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x10a4]
push 0x6526e0
push dword [0x67e924]
lea eax, [ebp - 0x10a0]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10a0]
mov dl, 1
call fcn.004241e8
test al, al
je 0x64f757
push 0
lea eax, [ebp - 0x10a8]
mov ecx, 0x6526f0
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x10a8]
call fcn.0040a13c
push eax
lea edx, [ebp - 0x10b0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x10b0]
push 0x65271c
push dword [0x67e924]
lea eax, [ebp - 0x10ac]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10ac]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x64f78a
lea eax, [ebp - 0x10b4]
mov ecx, 0x65272c
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x10b4]
mov dl, 1
mov eax, dword [0x507788]
call fcn.0050a934
mov dword [0x67e8dc], eax
mov ecx, dword [0x67e930]
mov edx, 0x652758
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67e930]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67e944], eax
mov ecx, dword [0x67e930]
mov edx, 0x652770
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67e930]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67e948], eax
mov ecx, dword [0x67e930]
mov edx, 0x65278c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67e930]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67e94c], eax
mov ecx, dword [0x67e930]
mov edx, 0x6527b4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67e930]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67e950], eax
mov ecx, dword [0x67e930]
mov edx, 0x6527e0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67e930]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67e954], eax
jmp 0x64f78a
call fcn.00430950
push eax
lea eax, [ebp - 0x10b8]
mov ecx, 0x652800
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x10b8]
mov dl, 1
mov eax, dword [0x507788]
call fcn.0050a96c
mov dword [0x67e8dc], eax
push 0
mov ecx, 0x65282c
mov edx, 0x652850
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x64f7c1
push 0
mov ecx, 0x652868
mov edx, 0x652890
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
je 0x6500f6
lea edx, [ebp - 0x10bc]
mov al, 0x1c
call fcn.00640d00
mov eax, dword [ebp - 0x10bc]
push eax
mov ecx, 0x6528a8
mov edx, 0x6528c4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x10c0]
mov al, 0x1d
call fcn.00640d00
mov eax, dword [ebp - 0x10c0]
push eax
mov ecx, 0x6528e0
mov edx, 0x652904
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10c8]
push eax
mov ecx, 0x652920
mov edx, 0x652930
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10c8]
lea edx, [ebp - 0x10c4]
call fcn.00642f7c
mov eax, dword [ebp - 0x10c4]
push eax
mov ecx, 0x652950
mov edx, 0x652960
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea eax, [ebp - 8]
call fcn.0040956c
push 0
mov ecx, 0x652980
mov edx, 0x65299c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64f8e6
push 0
mov ecx, 0x6529b4
mov edx, 0x6529cc
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64f8e6
lea eax, [ebp - 8]
mov edx, 0x6529e4
call fcn.00409994
push 0
mov ecx, 0x652aa0
mov edx, 0x652ab8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64f8e6
cmp dword [0x67e8bc], 0
jne 0x64f8d4
cmp dword [0x67e8b8], 0xe4e1c0
jbe 0x64f8e6
jmp 0x64f8d6
jle 0x64f8e6
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4b0]
mov dl, 1
call fcn.00541844
push 0
lea eax, [ebp - 0x10d4]
push eax
mov ecx, 0x652ad0
mov edx, 0x652ae0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00642f7c
mov ecx, dword [ebp - 0x10d0]
lea eax, [ebp - 0x10cc]
mov edx, dword [ebp - 8]
call fcn.0040a390
mov eax, dword [ebp - 0x10cc]
push eax
mov ecx, 0x652b00
mov edx, 0x652b10
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x652b30
mov edx, 0x652b40
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.00642f7c
mov eax, dword [ebp - 0x10d8]
push eax
mov ecx, 0x652b60
mov edx, 0x652b70
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10e4]
push eax
mov ecx, 0x652b90
mov edx, 0x652ba0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x10e0]
call fcn.00642f7c
mov eax, dword [ebp - 0x10e0]
push eax
mov ecx, 0x652bc0
mov edx, 0x652bd0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10ec]
push eax
mov ecx, 0x652bf0
mov edx, 0x652c00
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10ec]
lea edx, [ebp - 0x10e8]
call fcn.00642f7c
mov eax, dword [ebp - 0x10e8]
push eax
mov ecx, 0x652c20
mov edx, 0x652c30
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f4]
push eax
mov ecx, 0x652c50
mov edx, 0x652c60
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f4]
lea edx, [ebp - 0x10f0]
call fcn.00642f7c
mov eax, dword [ebp - 0x10f0]
push eax
mov ecx, 0x652c80
mov edx, 0x652c90
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10fc]
push eax
mov ecx, 0x652cb0
mov edx, 0x652cc0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10fc]
lea edx, [ebp - 0x10f8]
call fcn.00642f7c
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, 0x652ce0
mov edx, 0x652cf0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1104]
push eax
mov ecx, 0x652d10
mov edx, 0x652d20
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1104]
lea edx, [ebp - 0x1100]
call fcn.00642f7c
mov eax, dword [ebp - 0x1100]
push eax
mov ecx, 0x652d40
mov edx, 0x652d50
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x652d70
mov edx, 0x652d80
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x110c]
lea edx, [ebp - 0x1108]
call fcn.00642f7c
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x652da0
mov edx, 0x652db0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x652dd0
mov edx, 0x652de0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00642f7c
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x652e00
mov edx, 0x652e10
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x111c]
push eax
mov ecx, 0x652e30
mov edx, 0x652e40
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x111c]
lea edx, [ebp - 0x1118]
call fcn.00642f7c
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x652e5c
mov edx, 0x652e6c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1124]
push eax
mov ecx, 0x652e88
mov edx, 0x652e98
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00642f7c
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, 0x652eb4
mov edx, 0x652ec4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x112c]
push eax
mov ecx, 0x652ee0
mov edx, 0x652ef0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.00642f7c
mov eax, dword [ebp - 0x1128]
push eax
mov ecx, 0x652f0c
mov edx, 0x652f1c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1134]
push eax
mov ecx, 0x652f38
mov edx, 0x652f48
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1134]
lea edx, [ebp - 0x1130]
call fcn.00642f7c
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x652f64
mov edx, 0x652f74
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x113c]
push eax
mov ecx, 0x652f90
mov edx, 0x652fa0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x113c]
lea edx, [ebp - 0x1138]
call fcn.00642f7c
mov eax, dword [ebp - 0x1138]
push eax
mov ecx, 0x652fbc
mov edx, 0x652fcc
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1144]
push eax
mov ecx, 0x652fe8
mov edx, 0x652ff8
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1144]
lea edx, [ebp - 0x1140]
call fcn.00642f7c
mov eax, dword [ebp - 0x1140]
push eax
mov ecx, 0x653014
mov edx, 0x653024
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x114c]
push eax
mov ecx, 0x653040
mov edx, 0x653050
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x114c]
lea edx, [ebp - 0x1148]
call fcn.00642f7c
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65306c
mov edx, 0x65307c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1154]
push eax
mov ecx, 0x653098
mov edx, 0x6530a8
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1154]
lea edx, [ebp - 0x1150]
call fcn.00642f7c
mov eax, dword [ebp - 0x1150]
push eax
mov ecx, 0x6530c4
mov edx, 0x6530d4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x6530f0
mov edx, 0x653100
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00642f7c
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65311c
mov edx, 0x65312c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1164]
push eax
mov ecx, 0x653148
mov edx, 0x653158
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00642f7c
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x653174
mov edx, 0x653184
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x116c]
push eax
mov ecx, 0x6531a0
mov edx, 0x6531b4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x116c]
lea edx, [ebp - 0x1168]
call fcn.00642f7c
mov eax, dword [ebp - 0x1168]
push eax
mov ecx, 0x6531d0
mov edx, 0x6531e4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1174]
push eax
mov ecx, 0x653200
mov edx, 0x653214
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1174]
lea edx, [ebp - 0x1170]
call fcn.00642f7c
mov eax, dword [ebp - 0x1170]
push eax
mov ecx, 0x653230
mov edx, 0x653244
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x117c]
push eax
mov ecx, 0x653260
mov edx, 0x653274
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x117c]
lea edx, [ebp - 0x1178]
call fcn.00642f7c
mov eax, dword [ebp - 0x1178]
push eax
mov ecx, 0x653290
mov edx, 0x6532a4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1184]
push eax
mov ecx, 0x6532c0
mov edx, 0x6532d4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1184]
lea edx, [ebp - 0x1180]
call fcn.00642f7c
mov eax, dword [ebp - 0x1180]
push eax
mov ecx, 0x6532f0
mov edx, 0x653304
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x653320
mov edx, 0x653334
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x118c]
lea edx, [ebp - 0x1188]
call fcn.00642f7c
mov eax, dword [ebp - 0x1188]
push eax
mov ecx, 0x653350
mov edx, 0x653364
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x653380
mov edx, 0x653394
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00642f7c
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x6533b0
mov edx, 0x6533c4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x119c]
push eax
mov ecx, 0x6533e0
mov edx, 0x6533f4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x119c]
lea edx, [ebp - 0x1198]
call fcn.00642f7c
mov eax, dword [ebp - 0x1198]
push eax
mov ecx, 0x653410
mov edx, 0x653424
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11a4]
push eax
mov ecx, 0x653440
mov edx, 0x653454
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11a4]
lea edx, [ebp - 0x11a0]
call fcn.00642f7c
mov eax, dword [ebp - 0x11a0]
push eax
mov ecx, 0x653470
mov edx, 0x653484
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x6534a0
mov edx, 0x6534b4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ac]
lea edx, [ebp - 0x11a8]
call fcn.00642f7c
mov eax, dword [ebp - 0x11a8]
push eax
mov ecx, 0x6534d0
mov edx, 0x6534e4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x11b0]
mov al, 0x37
call fcn.00640d00
mov eax, dword [ebp - 0x11b0]
push eax
mov ecx, 0x653500
mov edx, 0x653518
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
movzx eax, byte [0x67e8e7]
xor al, 1
push eax
mov ecx, 0x653534
mov edx, 0x65354c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x67e8e0]
push eax
mov ecx, 0x653568
mov edx, 0x65357c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
mov eax, dword [ebp - 0x11b4]
push eax
mov ecx, 0x653598
mov edx, 0x6535bc
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [0x67e8fc], 0
je 0x6501aa
mov eax, dword [0x67e8fc]
push eax
mov ecx, 0x6535d8
mov edx, 0x653604
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x11b8]
mov al, 0x1a
call fcn.00640d00
mov eax, dword [ebp - 0x11b8]
push eax
mov ecx, 0x653620
mov edx, 0x65364c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x67e8e1], 0
je 0x650431
push 0
mov ecx, 0x653668
mov edx, 0x653694
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6536ac
mov edx, 0x6536d0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6536ec
mov edx, 0x653718
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653730
mov edx, 0x65375c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653778
mov edx, 0x6537a8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6537c0
mov edx, 0x6537f0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65380c
mov edx, 0x65383c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6502c5
push 0
lea eax, [ebp - 0x11c0]
push eax
mov ecx, 0x653854
mov edx, 0x653894
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11c0]
lea edx, [ebp - 0x11bc]
call fcn.00642f7c
mov eax, dword [ebp - 0x11bc]
push eax
mov ecx, 0x6538ac
mov edx, 0x6538ec
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x6502db
push 0
mov ecx, 0x653908
mov edx, 0x653948
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x653964
mov edx, 0x653998
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x650340
push 0
lea eax, [ebp - 0x11c8]
push eax
mov ecx, 0x6539b0
mov edx, 0x6539d8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11c8]
lea edx, [ebp - 0x11c4]
call fcn.00642f7c
mov eax, dword [ebp - 0x11c4]
push eax
mov ecx, 0x6539f0
mov edx, 0x653a18
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x650356
push 0
mov ecx, 0x653a34
mov edx, 0x653a5c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x653a78
mov edx, 0x653aa0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653ab8
mov edx, 0x653ae0
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653afc
mov edx, 0x653b2c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x650431
push 0
lea eax, [ebp - 0x11d0]
push eax
mov ecx, 0x653b44
mov edx, 0x653b7c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d0]
lea edx, [ebp - 0x11cc]
call fcn.00642f7c
mov eax, dword [ebp - 0x11cc]
push eax
mov ecx, 0x653b94
mov edx, 0x653bb4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11d8]
push eax
mov ecx, 0x653bd0
mov edx, 0x653c08
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d8]
lea edx, [ebp - 0x11d4]
call fcn.00642f7c
mov eax, dword [ebp - 0x11d4]
push eax
mov ecx, 0x653c20
mov edx, 0x653c48
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x653c64
mov edx, 0x653c80
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x650640
push 0
mov ecx, 0x653c98
mov edx, 0x653cc0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653cd8
mov edx, 0x653d00
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11e0]
push eax
mov ecx, 0x653d1c
mov edx, 0x653d3c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e0]
lea edx, [ebp - 0x11dc]
call fcn.00642f7c
mov eax, dword [ebp - 0x11dc]
push eax
mov ecx, 0x653d54
mov edx, 0x653d74
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x653d90
mov edx, 0x653dc0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653dd8
mov edx, 0x653e08
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653e24
mov edx, 0x653e58
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653e70
mov edx, 0x653ea4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653ec0
mov edx, 0x653ef4
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653f0c
mov edx, 0x653f40
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653f5c
mov edx, 0x653f88
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x653fa0
mov edx, 0x653fcc
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x653fe8
mov edx, 0x654014
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6505b6
push 0xffffffffffffffff
mov ecx, 0x65402c
mov edx, 0x654058
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push eax
mov ecx, 0x654070
mov edx, 0x65409c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
jmp 0x6505cc
push 0
mov ecx, 0x6540b8
mov edx, 0x6540e4
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
mov ecx, 0x654100
mov edx, 0x654130
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x654148
mov edx, 0x654178
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11e8]
push eax
mov ecx, 0x654194
mov edx, 0x6541c4
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e8]
lea edx, [ebp - 0x11e4]
call fcn.00642f7c
mov eax, dword [ebp - 0x11e4]
push eax
mov ecx, 0x6541dc
mov edx, 0x65420c
mov eax, dword [0x67e8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
cmp byte [0x67e8e0], 0
je 0x6506bd
xor eax, eax
push ebp
push 0x6506b3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x67e960], eax
push 0x65421c
push 0x65425c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x67e958], eax
push 0x654278
push 0x65425c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x67e95c], eax
push 0x67e960
call dword [0x67e958]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6506bd
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0x6542c0
lea eax, [ebp - 0x11ec]
push eax
mov ecx, 0x6542f4
mov edx, 0x654308
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x11ec]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
xor eax, eax
push ebp
push 0x650796
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x11f0]
xor eax, eax
call fcn.00406c04
mov ecx, dword [ebp - 0x11f0]
mov dl, 1
mov eax, dword [0x492d44]
call fcn.004b5ef8
mov dword [0x67e8a8], eax
mov eax, dword [0x67e8c8]
xor edx, edx
push edx
push eax
mov eax, dword [0x67e8a8]
call fcn.004b3930
push 0xff00
lea eax, [ebp - 0x11f4]
mov ecx, 0x654324
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x11f4]
mov dl, 1
mov eax, dword [0x492d44]
call fcn.004b5ef8
mov dword [0x67e8ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6507eb
xor esi, esi
mov eax, dword [0x67e8cc]
sub eax, esi
cmp eax, 0x1000
jb 0x650814
lea edx, [ebp - 0x1084]
mov ecx, 0x1000
mov eax, dword [0x67e8a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x650828
mov ecx, eax
lea edx, [ebp - 0x1084]
mov eax, dword [0x67e8a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x1084]
mov ecx, ebx
mov eax, dword [0x67e8ac]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x67e8cc]
mov dword [ebp - 0x11fc], eax
xor eax, eax
mov dword [ebp - 0x11f8], eax
fild qword [ebp - 0x11fc]
fdivr dword [0x654344]
mov dword [ebp - 0x11fc], esi
xor eax, eax
mov dword [ebp - 0x11f8], eax
fild qword [ebp - 0x11fc]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
call fcn.00577354
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
cmp ebx, 0x1000
je 0x6507ed
mov eax, dword [0x67e8ac]
call fcn.004078f0
mov eax, dword [0x67e8a8]
call fcn.004078f0
push 0x654354
lea eax, [ebp - 0x1200]
push eax
mov ecx, 0x654384
mov edx, 0x654394
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1200]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov dl, 1
mov eax, dword [0x6213a8]
call fcn.006274f8
mov dword [0x67e8b0], eax
xor eax, eax
push ebp
push 0x650943
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1204]
mov ecx, 0x6543b0
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov edx, dword [ebp - 0x1204]
mov cl, 1
mov eax, dword [0x67e8b0]
call fcn.00627578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650998
mov dl, 1
mov eax, dword [0x48feb4]
call fcn.004b3864
mov dword [ebp - 4], eax
mov byte [ebp - 0x66], 0
push 0
mov ecx, 0x6543dc
mov edx, 0x654400
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x64], eax
push 0
mov ecx, 0x654418
mov edx, 0x654444
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6509e8
mov eax, 0x65445c
call fcn.0058ad5c
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x6513e2
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
cmp byte [0x67e8e9], 0
je 0x650a0f
push ebp
call fcn.0064f300
pop ecx
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1208]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
mov ecx, dword [ebp - 0x1208]
mov edx, 0x6544b0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 8], 0
je 0x6513d6
push 0x6544c8
push dword [0x67e920]
push 0x6544f0
lea eax, [ebp - 0x120c]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x120c]
mov eax, dword [ebp - 8]
call fcn.0040a4c8
je 0x6513d6
movzx eax, byte [0x6544fc]
push eax
lea eax, [ebp - 0x1210]
push eax
mov ecx, 0x65450c
mov edx, 0x654520
mov eax, dword [ebp - 8]
call fcn.0042b814
mov edx, dword [ebp - 0x1210]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 3
jne 0x6513d6
lea ecx, [ebp - 0x1218]
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1218]
lea edx, [ebp - 0x1214]
call fcn.00642f7c
mov edx, dword [ebp - 0x1214]
lea eax, [ebp - 0x14]
call fcn.00409994
lea ecx, [ebp - 0x121c]
mov edx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x121c]
mov edx, 1
call fcn.00423858
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x1224]
mov edx, 2
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1224]
lea edx, [ebp - 0x1220]
call fcn.00422c28
mov eax, dword [ebp - 0x1220]
mov edx, 0x654530
call fcn.0040a4c8
sete al
xor al, 1
mov byte [ebp - 0xf], al
xor eax, eax
mov dword [ebp - 0x54], eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x654540
call fcn.0040a710
test eax, eax
jne 0x650be6
cmp byte [0x67e8ec], 0
jne 0x650b91
lea edx, [ebp - 0x1228]
mov eax, dword [ebp - 0x14]
call fcn.006449b4
mov edx, dword [ebp - 0x1228]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
call fcn.0054197c
xor eax, eax
push ebp
push 0x650bdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x122c]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
mov edx, dword [ebp - 0x122c]
mov eax, dword [0x67e8b0]
call fcn.00628f30
mov edx, eax
lea ecx, [ebp - 0x4a]
mov eax, dword [0x67e8b0]
call fcn.00626494
mov eax, dword [ebp - 0x42]
mov dword [ebp - 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650be6
fild dword [ebp - 0x64]
fdivr dword [0x654344]
fild dword [ebp - 0x58]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
call fcn.00577354
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x654568
call fcn.0040a710
test eax, eax
jne 0x650e86
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241e8
test al, al
je 0x650e86
cmp byte [0x67e8e2], 0
je 0x650c54
cmp byte [ebp - 0x10], 0
jne 0x650c54
mov byte [ebp - 0x10], 1
cmp byte [ebp - 0x66], 0
jne case.0x650cbf.0
cmp byte [ebp - 0x10], 0
jne case.0x650cbf.0
push 0
push 0
lea eax, [ebp - 0x1234]
push eax
mov ecx, 0x654590
mov edx, 0x6545a4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1234]
lea ecx, [ebp - 0x1230]
mov edx, dword [ebp - 0x14]
call fcn.00643998
mov eax, dword [ebp - 0x1230]
movzx ecx, word [0x6545b8]
xor edx, edx
call fcn.0058abc4
cmp eax, 0xe
ja case.0x650cbf.0
movzx eax, byte [eax + 0x650cc6]
jmp dword [eax*4 + 0x650cd5]
mov byte [ebp - 0x10], 1
jmp case.0x650cbf.0
mov byte [ebp - 0x10], 3
jmp case.0x650cbf.0
mov byte [ebp - 0x66], 1
mov byte [ebp - 0x10], 1
jmp case.0x650cbf.0
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x10], 3
jmp case.0x650cbf.0
mov eax, dword [ebp - 0x50]
call fcn.00610d44
cmp byte [0x67e8e9], 0
je 0x6513d6
mov eax, dword [0x67e8b0]
call fcn.004078f0
push ebp
call fcn.0064f300
pop ecx
jmp 0x6513d6
cmp byte [ebp - 0x10], 1
je 0x650d44
cmp byte [ebp - 0x66], 1
jne 0x650d6e
xor eax, eax
push ebp
push 0x650d64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.0042487c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x650d6e
movzx eax, byte [ebp - 0x10]
cmp al, 3
je 0x650d7c
cmp byte [ebp - 0x66], 3
jne 0x650d89
mov eax, dword [ebp - 0x14]
call fcn.0064f07c
jmp 0x6513d6
cmp al, 2
jne 0x650e86
push 0
lea edx, [ebp - 0x1238]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
mov edx, dword [ebp - 0x1238]
mov ecx, dword [0x67e8f4]
mov eax, dword [0x67e8b0]
call fcn.00627ad4
push dword [0x67e8f4]
push 0x6545c8
lea edx, [ebp - 0x1240]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
push dword [ebp - 0x1240]
lea eax, [ebp - 0x123c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x123c]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x14]
call fcn.0064eec8
test al, al
je 0x650e3f
mov eax, dword [ebp - 0x14]
call fcn.0042487c
push dword [0x67e8f4]
push 0x6545d8
lea edx, [ebp - 0x1248]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
push dword [ebp - 0x1248]
lea eax, [ebp - 0x1244]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1244]
call fcn.0042487c
jmp 0x650e86
push dword [0x67e8f4]
push 0x6545e8
lea edx, [ebp - 0x1250]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
push dword [ebp - 0x1250]
lea eax, [ebp - 0x124c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x124c]
call fcn.0042487c
mov eax, dword [ebp - 0x14]
call fcn.0064f07c
jmp 0x6513d6
lea eax, [ebp - 0x1254]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1254]
mov edx, 0x6545f8
call fcn.0040a4c8
jne 0x650eea
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x650ebd
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65460c
call fcn.0040a710
add eax, 3
jmp 0x650eef
mov eax, 3
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x650f09
mov eax, dword [ebp - 0x80]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
sub edx, eax
jl 0x6510e5
inc edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x5c]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x6510d9
lea eax, [ebp - 0x1258]
push eax
mov ebx, dword [ebp - 0x5c]
dec ebx
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1258]
mov dl, 1
call fcn.00424280
test al, al
jne 0x6510d9
xor eax, eax
push ebp
push 0x650fa0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x125c]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x125c]
call fcn.004069bc
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6510a2
cmp byte [0x67e8e1], 0
je 0x6510d9
cmp byte [ebp - 0xf], 0
je 0x6510d9
lea eax, [ebp - 0x1278]
push eax
mov ecx, dword [ebp - 0x5c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov edx, dword [ebp - 0x1278]
mov eax, 0x6546e8
call fcn.00644dc4
inc dword [ebp - 0x5c]
dec dword [ebp - 0x78]
jne 0x650f1e
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x654704
call fcn.0040a710
test eax, eax
jg 0x6513d6
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241e8
test al, al
je 0x651224
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x14]
call fcn.00424b48
mov eax, dword [ebp - 0x127c]
mov edx, 0x65472c
call fcn.0040a4c8
jne 0x651161
push 1
push 0
push 0x654744
push 0x654788
push 0x654798
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004245b4
test eax, 1
jle 0x6511a4
xor eax, eax
push ebp
push 0x65119a
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x80
mov eax, dword [ebp - 0x14]
call fcn.0042466c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6511a4
lea edx, [ebp - 0x1284]
mov eax, dword [ebp - 0x14]
call fcn.00424b84
mov eax, dword [ebp - 0x1284]
lea edx, [ebp - 0x1280]
call fcn.0042281c
mov eax, dword [ebp - 0x1280]
mov edx, 0x6547b0
call fcn.0040a4c8
je 0x651206
lea edx, [ebp - 0x128c]
mov eax, dword [ebp - 0x14]
call fcn.00424b84
mov eax, dword [ebp - 0x128c]
lea edx, [ebp - 0x1288]
call fcn.0042281c
mov eax, dword [ebp - 0x1288]
mov edx, 0x6547c8
call fcn.0040a4c8
jne 0x651224
mov eax, dword [ebp - 0x14]
call fcn.0064ef7c
push 0x12c
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov byte [ebp - 0x65], 0
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241e8
test al, al
je 0x651260
xor eax, eax
push ebp
push 0x651256
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.0042487c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651260
xor eax, eax
push ebp
push 0x65129e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
mov edx, dword [ebp - 0x1290]
mov ecx, dword [ebp - 0x14]
mov eax, dword [0x67e8b0]
call fcn.00627b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651359
cmp byte [ebp - 0x65], 0
jne 0x651224
xor eax, eax
push ebp
push 0x651386
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x42]
mov eax, dword [ebp - 0x14]
call fcn.0042451c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6513ae
cmp byte [0x67e8e1], 0
je 0x6513ca
cmp byte [ebp - 0xf], 0
je 0x6513ca
mov edx, dword [ebp - 0x14]
mov eax, 0x6548a8
call fcn.00644dc4
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x6509ff
xor eax, eax
push ebp
push 0x65140e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e8b0]
call fcn.006276e8
mov eax, dword [0x67e8b0]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651418
push 0x6548c0
lea eax, [ebp - 0x12a4]
push eax
mov ecx, 0x6548f4
mov edx, 0x654908
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov ecx, dword [ebp - 4]
mov edx, 0x654924
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x65152b
push 0x654944
lea eax, [ebp - 0x12a8]
push eax
mov ecx, 0x65497c
mov edx, 0x65498c
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12a8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65151b
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12ac]
push eax
lea ecx, [ebp - 0x12b0]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12b0]
mov edx, 0x6549a8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12ac]
mov eax, dword [ebp - 0x50]
call fcn.00646498
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x6514d6
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
cmp byte [0x67e8e1], 0
je 0x6515f2
cmp byte [0x67e8ed], 0
jne 0x6515f2
lea edx, [ebp - 0x12b8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x12b8]
push 0x6549c8
push dword [0x67e920]
lea eax, [ebp - 0x12b4]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12b4]
mov eax, 0x6549d8
call fcn.00644dc4
lea edx, [ebp - 0x12c0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x12c0]
push 0x6549f0
movzx eax, byte [0x6549f4]
push eax
lea eax, [ebp - 0x12c4]
push eax
mov ecx, 0x654a04
mov edx, 0x654a1c
mov eax, dword [0x67e920]
call fcn.0042b814
push dword [ebp - 0x12c4]
lea eax, [ebp - 0x12bc]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12bc]
mov eax, 0x654a34
call fcn.00644dc4
push 0
mov ecx, 0x654a4c
mov edx, 0x654a64
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x652010
push 0
mov ecx, 0x654a7c
mov edx, 0x654aa0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jle 0x65171b
push 0x654ab8
lea eax, [ebp - 0x12c8]
push eax
mov ecx, 0x654aec
mov edx, 0x654b00
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
cmp byte [0x67e8e2], 0
je 0x65168f
mov word [ebp - 0x6e], 0
jmp 0x651695
mov word [ebp - 0x6e], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x654b1c
mov edx, 0x654b4c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0xc], 0
jne 0x6516c2
lea eax, [ebp - 0xc]
mov edx, 0x654b64
call fcn.00409994
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x6516ce
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x65171b
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x65171b
mov word [ebp - 0x6e], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x651703
mov eax, dword [ebp - 0x84]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x84]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040a500
push 0
mov ecx, 0x654b9c
mov edx, 0x654bc0
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
je 0x651740
dec eax
je 0x651848
jmp 0x6519fe
push 0
lea eax, [ebp - 0x12d0]
push eax
mov ecx, 0x654bd8
mov edx, 0x654c00
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x12d0]
lea eax, [ebp - 0x12cc]
mov edx, 0x654c18
call fcn.0040a390
mov eax, dword [ebp - 0x12cc]
lea edx, [ebp - 8]
call fcn.00642f7c
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241e8
test al, al
jne 0x65179d
lea eax, [ebp - 8]
mov edx, dword [0x67e914]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241e8
test al, al
je 0x65183c
lea edx, [ebp - 0x12d4]
mov eax, 0x654c40
call fcn.00642f7c
mov eax, dword [ebp - 0x12d4]
mov dl, 1
call fcn.004241e8
test al, al
je 0x65183c
movzx eax, word [ebp - 0x6e]
push eax
push 1
push 0
push 0x654c7c
push dword [ebp - 8]
push 0x654c90
push dword [ebp - 0xc]
lea eax, [ebp - 0x12dc]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x12dc]
lea edx, [ebp - 0x12d8]
call fcn.00642f7c
mov eax, dword [ebp - 0x12d8]
push eax
lea edx, [ebp - 0x12e0]
mov eax, 0x654ca4
call fcn.00642f7c
mov eax, dword [ebp - 0x12e0]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab4c
pop edx
pop ecx
call fcn.0064a800
jmp 0x6519fe
mov byte [0x67e8e8], 1
jmp 0x6519fe
push 0
lea eax, [ebp - 0x12e4]
push eax
mov ecx, 0x654ce0
mov edx, 0x654d08
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x12e4]
lea edx, [ebp - 8]
call fcn.00642f7c
cmp dword [ebp - 8], 0
je 0x6519f7
lea edx, [ebp - 0x12e8]
mov eax, dword [ebp - 8]
call fcn.0064f208
cmp dword [ebp - 0x12e8], 0
je 0x6519f7
lea edx, [ebp - 0x12ec]
mov eax, 0x654d20
call fcn.00642f7c
mov eax, dword [ebp - 0x12ec]
mov dl, 1
call fcn.004241e8
test al, al
je 0x6519f7
push 1
push 1
push 0
push 0x654d68
push dword [ebp - 8]
push 0x654d80
lea edx, [ebp - 0x12f8]
mov eax, dword [ebp - 8]
call fcn.0064f208
push dword [ebp - 0x12f8]
push 0x654db8
lea eax, [ebp - 0x12f4]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0x12f4]
lea edx, [ebp - 0x12f0]
call fcn.00642f7c
mov eax, dword [ebp - 0x12f0]
push eax
lea edx, [ebp - 0x12fc]
mov eax, 0x654dc8
call fcn.00642f7c
mov eax, dword [ebp - 0x12fc]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab4c
pop edx
pop ecx
call fcn.0064a800
test al, al
je 0x6519ee
mov eax, dword [0x67e900]
mov edx, 0x654e10
call fcn.0040a4c8
je 0x6519e5
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
movzx eax, word [ebp - 0x6e]
push eax
push 1
push 0
push 0x654e20
lea edx, [ebp - 0x1308]
mov eax, dword [ebp - 8]
call fcn.0064f208
push dword [ebp - 0x1308]
push 0x654e54
push dword [ebp - 0xc]
lea eax, [ebp - 0x1304]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x1304]
lea edx, [ebp - 0x1300]
call fcn.00642f7c
mov eax, dword [ebp - 0x1300]
push eax
lea edx, [ebp - 0x130c]
mov eax, 0x654e68
call fcn.00642f7c
mov eax, dword [ebp - 0x130c]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab4c
pop edx
pop ecx
call fcn.0064a800
test al, al
jne 0x6519fe
mov byte [0x67e8e8], 1
jmp 0x6519fe
mov byte [0x67e8e8], 1
jmp 0x6519fe
mov byte [0x67e8e8], 1
jmp 0x6519fe
mov byte [0x67e8e8], 1
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4a8]
cmp byte [eax + 0x69], 0
je 0x651b0f
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4a8]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x651b0f
push 0x654ea4
lea eax, [ebp - 0x1310]
push eax
mov ecx, 0x654ee4
mov edx, 0x654ef4
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1310]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov ecx, dword [ebp - 4]
mov edx, 0x654f10
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x651ae3
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x1314]
push eax
lea ecx, [ebp - 0x1318]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1318]
mov edx, 0x654f34
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1314]
mov eax, dword [ebp - 0x50]
call fcn.006490cc
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651a9e
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov ecx, dword [ebp - 4]
mov edx, 0x654f58
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x651bf1
push 0x654f78
lea eax, [ebp - 0x131c]
push eax
mov ecx, 0x654fc0
mov edx, 0x654fd0
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x131c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x651be1
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
cmp byte [0x67e8e9], 0
jne 0x651be1
push 0
lea eax, [ebp - 0x1320]
push eax
lea ecx, [ebp - 0x1324]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1324]
mov edx, 0x654fec
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1320]
mov eax, dword [ebp - 0x50]
call fcn.0064786c
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651b93
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov ecx, dword [ebp - 4]
mov edx, 0x65500c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x651cae
push 0x655020
lea eax, [ebp - 0x1328]
push eax
mov ecx, 0x65505c
mov edx, 0x65506c
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1328]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, 0x67e928
call fcn.0040956c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x651cae
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x132c]
push eax
lea ecx, [ebp - 0x1330]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1330]
mov edx, 0x655088
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x132c]
mov eax, dword [ebp - 0x50]
call fcn.00648898
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651c69
push 0
mov ecx, 0x65509c
mov edx, 0x6550c8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x651d0c
push 0xffffffffffffffff
mov ecx, 0x6550e0
mov edx, 0x65510c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x651d0c
cmp byte [0x67e8e7], 0
je 0x651cff
mov edx, 0x655124
mov eax, dword [ebp - 0x50]
call fcn.0064786c
jmp 0x651d0c
mov edx, 0x655230
mov eax, dword [ebp - 0x50]
call fcn.0064786c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4cc]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x651d88
cmp byte [0x67e8e7], 0
je 0x651d5a
push 0x65533c
push dword [0x67e8fc]
push 0x6553d8
lea eax, [ebp - 0x1334]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1334]
mov eax, dword [ebp - 0x50]
call fcn.0064786c
jmp 0x651d88
push 0x65540c
push dword [0x67e8fc]
push 0x6554a8
lea eax, [ebp - 0x1338]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1338]
mov eax, dword [ebp - 0x50]
call fcn.0064786c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov ecx, dword [ebp - 4]
mov edx, 0x6554dc
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x651e9b
push 0x655504
lea eax, [ebp - 0x133c]
push eax
mov ecx, 0x65554c
mov edx, 0x65555c
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x133c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x651e4b
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x1340]
push eax
lea ecx, [ebp - 0x1344]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1344]
mov edx, 0x655578
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1340]
mov eax, dword [ebp - 0x50]
call fcn.00649d78
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651e06
xor eax, eax
push ebp
push 0x651e81
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
push eax
push 0x1388
push 2
push 0x655594
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x651e8b
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
push 0x6555b8
lea eax, [ebp - 0x1348]
push eax
mov ecx, 0x6555ec
mov edx, 0x655600
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1348]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
mov ecx, dword [ebp - 4]
mov edx, 0x65561c
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x651f4a
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x134c]
push eax
lea ecx, [ebp - 0x1350]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1350]
mov edx, 0x655638
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x134c]
mov eax, dword [ebp - 0x50]
call fcn.0064bddc
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651f05
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054197c
mov ecx, dword [ebp - 4]
mov edx, 0x655654
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x652010
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x1354]
push eax
lea ecx, [ebp - 0x1358]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1358]
mov edx, 0x655674
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1354]
mov ax, 4
call fcn.0064c810
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x1360]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1360]
mov edx, 0x655694
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x135c]
mov ax, 5
call fcn.0064c810
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x651f88
cmp byte [0x67e8e0], 0
je 0x652047
xor eax, eax
push ebp
push 0x65203d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e960]
push eax
call dword [0x67e95c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x652047
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
mov edx, 0x64
call fcn.00577354
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0x1f4
call sub.kernel32.dll_Sleep_2
push 0x6556b4
lea eax, [ebp - 0x1364]
push eax
mov ecx, 0x6556e8
mov edx, 0x6556fc
mov eax, dword [0x67e8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1364]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054197c
cmp byte [0x67e8e1], 0
je 0x6520cc
push 0
mov ecx, 0x655718
mov edx, 0x655740
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6520cc
call fcn.0064e0ac
push 0
mov ecx, 0x655758
mov edx, 0x655788
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x652104
push 0
mov ecx, 0x6557a0
mov edx, 0x6557d4
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6521b0
lea edx, [ebp - 0x1368]
mov eax, 0x6557ec
call fcn.00642f7c
mov eax, dword [ebp - 0x1368]
mov dl, 1
call fcn.004241e8
test al, al
je 0x6521b0
xor eax, eax
push ebp
push 0x6521a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x136c]
mov eax, 0x655834
call fcn.00642f7c
mov eax, dword [ebp - 0x136c]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1370]
mov ecx, 0x655878
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1370]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1374]
mov eax, 0x6558a4
call fcn.00642f7c
mov edx, dword [ebp - 0x1374]
mov eax, 0x6558e8
call fcn.00644dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6521b0
xor eax, eax
push ebp
push 0x6521da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e930]
call fcn.004078f0
mov eax, dword [ebp - 4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6521e4
xor eax, eax
push ebp
push 0x652210
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67e8dc]
mov edx, dword [eax]
call dword [edx + 0x60]
mov eax, dword [0x67e8dc]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65221a
cmp byte [0x67e8e1], 0
je 0x6523bc
cmp byte [0x67e8ed], 0
jne 0x65233e
push 0
lea edx, [ebp - 0x137c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x137c]
push 0x655900
push dword [0x67e920]
lea eax, [ebp - 0x1378]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1378]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1380]
mov ecx, 0x655910
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1380]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x652337
push 0
lea edx, [ebp - 0x1388]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x1388]
push 0x65593c
movzx eax, byte [0x6549f4]
push eax
lea eax, [ebp - 0x138c]
push eax
mov ecx, 0x65594c
mov edx, 0x655964
mov eax, dword [0x67e920]
call fcn.0042b814
push dword [ebp - 0x138c]
lea eax, [ebp - 0x1384]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1384]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1390]
mov ecx, 0x65597c
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1390]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65233e
mov byte [0x67e8e8], 1
cmp byte [0x67e8ed], 0
je 0x6523bc
push 0
lea edx, [ebp - 0x1398]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
push dword [ebp - 0x1398]
push 0x6559a8
push dword [0x67e924]
lea eax, [ebp - 0x1394]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1394]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x139c]
mov ecx, 0x6559b8
mov edx, dword [0x67e8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x139c]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x6523bc
mov byte [0x67e8e8], 1
push 0
mov ecx, 0x6559e4
mov edx, 0x655a10
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65245c
push 0xffffffffffffffff
mov ecx, 0x655a28
mov edx, 0x655a54
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jle 0x65245c
push 5
push 0
push 1
lea edx, [ebp - 0x13a4]
mov eax, dword [ebp - 0x58]
call fcn.004235ac
mov ecx, dword [ebp - 0x13a4]
lea eax, [ebp - 0x13a0]
mov edx, 0x655a6c
call fcn.0040a390
mov eax, dword [ebp - 0x13a0]
push eax
lea edx, [ebp - 0x13a8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.00541928
lea eax, [ebp - 0x13a8]
mov edx, 0x655a98
call fcn.0040a338
mov edx, dword [ebp - 0x13a8]
xor eax, eax
pop ecx
call fcn.0064a800
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
push 0
mov ecx, 0x655ac0
mov edx, 0x655ad8
mov eax, dword [0x67e8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x652489
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6525f1
lea eax, [ebp - 0x13a8]
call fcn.0040956c
lea eax, [ebp - 0x13a4]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x1398]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1390]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1388]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1380]
call fcn.0040956c
lea eax, [ebp - 0x137c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1374]
mov edx, 0x2d
call fcn.004095cc
lea eax, [ebp - 0x12c0]
mov edx, 4
call fcn.004095cc
lea eax, [ebp - 0x12b0]
mov edx, 0x26
call fcn.004095cc
lea eax, [ebp - 0x1218]
mov edx, 7
call fcn.004095cc
lea eax, [ebp - 0x11f4]
mov edx, 0x10
call fcn.004095cc
lea eax, [ebp - 0x11b4]
call fcn.0040956c
lea eax, [ebp - 0x11b0]
mov edx, 0x40
call fcn.004095cc
lea eax, [ebp - 0x10b0]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x10a8]
call fcn.0040956c
lea eax, [ebp - 0x10a4]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x109c]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x1090]
call fcn.0040956c
lea eax, [ebp - 0x108c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x14]
mov edx, dword [0x64f2a0]
call fcn.0040aa44
lea eax, [ebp - 0x4a]
mov edx, dword [0x621058]
call fcn.0040aa44
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004095cc
ret