Function at 0x665b64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x34
push 0
push 0
dec ecx
jne 0x665b6c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x667658
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x685940
call fcn.0040956c
lea eax, [ebp - 4]
call fcn.0040956c
lea eax, [ebp - 8]
call fcn.0040956c
mov dl, 1
mov eax, dword [0x50d720]
call fcn.0050e86c
mov ebx, eax
cmp byte [0x6858e4], 0
je 0x665bc3
mov dword [ebx + 0x18], 0x20119
jmp 0x665bca
mov dword [ebx + 0x18], 0x20019
cmp byte [0x6858eb], 0
je 0x665be1
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e954
jmp 0x665bed
mov edx, 0x80000002
mov eax, ebx
call fcn.0050e954
lea edx, [ebp - 0x2c]
mov al, 0x37
call fcn.00646c70
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x667678
call fcn.0040a390
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, ebx
call fcn.0050eaac
test al, al
je 0x665c5c
mov edx, 0x6676f0
mov eax, ebx
call fcn.0050fa1c
test al, al
je 0x665c36
lea ecx, [ebp - 4]
mov edx, 0x66771c
mov eax, ebx
call fcn.0050f488
mov edx, 0x667748
mov eax, ebx
call fcn.0050fa1c
test al, al
je 0x665c55
lea ecx, [ebp - 8]
mov edx, 0x667774
mov eax, ebx
call fcn.0050f488
mov eax, ebx
call fcn.0050e924
cmp dword [ebp - 4], 0
jne 0x665cf8
cmp byte [0x6858eb], 0
je 0x665c7d
mov edx, 0x80000002
mov eax, ebx
call fcn.0050e954
jmp 0x665c89
mov edx, 0x80000001
mov eax, ebx
call fcn.0050e954
lea edx, [ebp - 0x34]
mov al, 0x37
call fcn.00646c70
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x6677a0
call fcn.0040a390
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, ebx
call fcn.0050eaac
test al, al
je 0x665cf8
mov edx, 0x667818
mov eax, ebx
call fcn.0050fa1c
test al, al
je 0x665cd2
lea ecx, [ebp - 4]
mov edx, 0x667844
mov eax, ebx
call fcn.0050f488
mov edx, 0x667870
mov eax, ebx
call fcn.0050fa1c
test al, al
je 0x665cf1
lea ecx, [ebp - 8]
mov edx, 0x66789c
mov eax, ebx
call fcn.0050f488
mov eax, ebx
call fcn.0050e924
mov eax, ebx
call fcn.004078f0
cmp dword [ebp - 0x14], 2
jle 0x665d0d
lea eax, [ebp - 4]
call fcn.0040956c
push 0
mov ecx, 0x6678c8
mov edx, 0x6678ec
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jne 0x666207
push 0
mov ecx, 0x667904
mov edx, 0x667938
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x665d9d
mov dl, 1
mov eax, dword [0x68592c]
call fcn.00424288
test al, al
je 0x665d9d
lea edx, [ebp - 0x38]
mov al, 0x1d
call fcn.00646c70
mov eax, dword [ebp - 0x38]
mov ecx, 1
mov edx, dword [0x68592c]
call fcn.0040a710
test eax, eax
jne 0x665d9d
push dword [0x68592c]
push 0x667950
lea edx, [ebp - 0x3c]
mov al, 0x1d
call fcn.00646c70
push dword [ebp - 0x3c]
mov eax, 0x68592c
mov edx, 3
call fcn.0040a418
cmp dword [ebp - 4], 0
je 0x666207
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004241f0
test al, al
je 0x666207
cmp byte [0x6858e6], 0
jne 0x665ec8
cmp dword [ebp - 8], 0
je 0x665ec8
lea edx, [ebp - 0x40]
mov al, 0x1d
call fcn.00646c70
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 8]
call fcn.0040a4c8
je 0x665ec8
lea edx, [ebp - 0x44]
mov al, 0x1d
call fcn.00646c70
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.006563a4
test al, al
jne 0x665ec8
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x667960
mov edx, 0x667974
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x64]
mov al, 0x1c
call fcn.00646c70
push dword [ebp - 0x64]
push 0x667994
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0x11
lea edx, [ebp - 0x68]
mov al, 0x1d
call fcn.00646c70
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0x11
lea edx, [ebp - 0x5c]
mov ecx, 1
pop eax
call fcn.004252f4
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0xc]
call fcn.00648f98
push 0x134
lea edx, [ebp - 0x6c]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x6c]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 7
jne 0x665ec8
mov eax, 0xb
call fcn.006636f8
cmp byte [0x6858e6], 0
jne 0x666011
push 0
mov ecx, 0x6679a4
mov edx, 0x6679dc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666011
movzx eax, byte [0x6679e8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x6679f8
mov edx, 0x667a10
mov eax, dword [ebp - 4]
call fcn.0042b81c
lea eax, [ebp - 0xc]
call fcn.0040956c
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.004241f0
test al, al
je 0x665f81
xor eax, eax
push ebp
push 0x665f77
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a8dc
mov dword [0x6858e0], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x667a28
mov edx, 0x667a54
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x6858e0]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x665f81
cmp dword [ebp - 0xc], 0
je 0x666011
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004241f0
test al, al
je 0x666011
jmp 0x666005
push 0x35
lea edx, [ebp - 0x70]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x70]
call fcn.0040a13c
push eax
push 0
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x667a70
mov edx, 0x667a80
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x78]
push eax
lea edx, [ebp - 0x7c]
mov al, 0x1c
call fcn.00646c70
mov edx, dword [ebp - 0x7c]
lea ecx, [ebp - 0x74]
pop eax
call fcn.00649bf8
mov eax, dword [ebp - 0x74]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 2
je 0x666011
mov eax, dword [ebp - 0xc]
call fcn.00637ea4
test al, al
jne 0x665f9b
push 1
mov ecx, 0x667aa0
mov edx, 0x667acc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666207
inc dword [ebp - 0x14]
cmp byte [0x6858e6], 0
jne 0x666055
push 0
mov ecx, 0x667ae4
mov edx, 0x667b1c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6660bc
push 1
push 1
cmp dword [ebp - 0x14], 2
setl al
xor al, 1
push eax
mov eax, dword [ebp - 4]
call fcn.0040a13c
mov edx, eax
lea eax, [ebp - 0x80]
call fcn.0040a1a4
mov edx, dword [ebp - 0x80]
mov ecx, 0x667b34
xor eax, eax
call fcn.006519e4
jmp 0x666090
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
call fcn.00424b50
mov eax, dword [ebp - 0x84]
call fcn.00637ea4
test al, al
jne 0x666086
push 0x12c
call sub.kernel32.dll_Sleep_2
jmp 0x665b93
xor eax, eax
push ebp
push 0x666131
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x88]
push eax
push 0
lea eax, [ebp - 0x8c]
push eax
mov ecx, 0x667b48
mov edx, 0x667b5c
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [0x685900]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0x11
lea edx, [ebp - 0x5c]
mov ecx, 1
pop eax
call fcn.004252f4
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0xc]
call fcn.00648f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x666155
push 0x34
lea edx, [ebp - 0x90]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x90]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 7
jne 0x66619d
mov eax, 0xb
call fcn.006636f8
jmp 0x666207
push 1
push 1
cmp dword [ebp - 0x14], 2
setl al
xor al, 1
push eax
mov eax, dword [ebp - 4]
call fcn.0040a13c
mov edx, eax
lea eax, [ebp - 0x94]
call fcn.0040a1a4
mov edx, dword [ebp - 0x94]
xor ecx, ecx
xor eax, eax
call fcn.006519e4
jmp 0x6661db
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 4]
call fcn.00424b50
mov eax, dword [ebp - 0x98]
call fcn.00637ea4
test al, al
jne 0x6661d1
push 0x12c
call sub.kernel32.dll_Sleep_2
jmp 0x665b93
cmp byte [0x6858eb], 0
je 0x66626d
lea edx, [ebp - 0x9c]
mov al, 0x14
call fcn.00646c70
push dword [ebp - 0x9c]
push 0x667bb0
push 0
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x667bc0
mov edx, 0x667be8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00648f98
push dword [ebp - 0xa0]
mov eax, 0x685930
mov edx, 3
call fcn.0040a418
jmp 0x6662c8
lea edx, [ebp - 0xa8]
mov al, 0x18
call fcn.00646c70
push dword [ebp - 0xa8]
push 0x667c00
push 0
lea eax, [ebp - 0xb0]
push eax
mov ecx, 0x667c10
mov edx, 0x667c38
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.00648f98
push dword [ebp - 0xac]
mov eax, 0x685930
mov edx, 3
call fcn.0040a418
push 0
mov ecx, 0x667c50
mov edx, 0x667c74
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x666869
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004241f0
test al, al
jne 0x6663ca
cmp byte [0x6858e6], 0
jne 0x6663c0
push 0x30
lea edx, [ebp - 0xb4]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0xb4]
call fcn.0040a13c
push eax
push 0
lea eax, [ebp - 0xc0]
push eax
mov ecx, 0x667c8c
mov edx, 0x667ca0
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov al, 0x1c
call fcn.00646c70
mov edx, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
pop eax
call fcn.00649bf8
push dword [ebp - 0xbc]
push 0x667cc0
lea edx, [ebp - 0xcc]
mov al, 0x1f
call fcn.00646c70
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.00655554
push dword [ebp - 0xc8]
lea eax, [ebp - 0xb8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0xb8]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
mov eax, 0xc
call fcn.006636f8
push 0
mov ecx, 0x667cd8
mov edx, 0x667d00
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x66666e
xor ebx, ebx
push 0
lea eax, [ebp - 0xd0]
push eax
mov ecx, 0x667d18
mov edx, 0x667d3c
mov eax, dword [0x6858d8]
mov esi, dword [eax]
call dword [esi + 4]
cmp dword [ebp - 0xd0], 0
je 0x666443
push 0
lea eax, [ebp - 0xd4]
push eax
mov ecx, 0x667d54
mov edx, 0x667d78
mov eax, dword [0x6858d8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.006563a4
test al, al
je 0x666443
mov bl, 1
push 0
lea eax, [ebp - 0xd8]
push eax
mov ecx, 0x667d90
mov edx, 0x667db4
mov eax, dword [0x6858d8]
mov esi, dword [eax]
call dword [esi + 4]
cmp dword [ebp - 0xd8], 0
je 0x66649c
push 0
lea eax, [ebp - 0xdc]
push eax
mov ecx, 0x667dcc
mov edx, 0x667df0
mov eax, dword [0x6858d8]
mov esi, dword [eax]
call dword [esi + 4]
mov edx, dword [ebp - 0xdc]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.006563a4
test al, al
je 0x66649c
mov bl, 1
test bl, bl
je 0x66666e
cmp byte [0x6858e6], 0
jne 0x666664
push 0
lea eax, [ebp - 0xe0]
push eax
mov ecx, 0x667e08
mov edx, 0x667e2c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xe0]
push eax
push 0
lea eax, [ebp - 0xe4]
push eax
mov ecx, 0x667e44
mov edx, 0x667e68
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0xe4]
pop eax
call fcn.0040a4c8
jne 0x666587
lea edx, [ebp - 0xec]
mov al, 0x1c
call fcn.00646c70
push dword [ebp - 0xec]
push 0x667e80
push 0
lea eax, [ebp - 0xf0]
push eax
mov ecx, 0x667e94
mov edx, 0x667eb8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
push dword [ebp - 0xf0]
lea eax, [ebp - 0xe8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0xe8]
push eax
push 0
lea eax, [ebp - 0xf4]
push eax
mov ecx, 0x667ed0
mov edx, 0x667ee4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xc]
pop edx
call fcn.00649bf8
jmp 0x66662d
lea edx, [ebp - 0xfc]
mov al, 0x1c
call fcn.00646c70
push dword [ebp - 0xfc]
push 0x667f04
push 0
lea eax, [ebp - 0x100]
push eax
mov ecx, 0x667f18
mov edx, 0x667f3c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
push dword [ebp - 0x100]
push 0x667f54
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, 0x667f68
mov edx, 0x667f8c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
push dword [ebp - 0x104]
lea eax, [ebp - 0xf8]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0xf8]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x667fa4
mov edx, 0x667fb8
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0xc]
pop edx
call fcn.00649bf8
push 0x30
lea edx, [ebp - 0x10c]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x10c]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
mov eax, 0xc
call fcn.006636f8
mov byte [0x68594a], 1
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00424b50
mov edx, dword [ebp - 0x110]
mov eax, 0x685940
call fcn.0040994c
movzx eax, byte [0x6679e8]
push eax
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x667fd8
mov edx, 0x667ff0
mov eax, dword [0x685940]
call fcn.0042b81c
mov edx, dword [ebp - 0x114]
mov eax, 0x685940
call fcn.0040994c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x84]
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00424a08
mov edx, dword [ebp - 0x118]
mov eax, 0x68592c
call fcn.0040994c
push 0
lea eax, [ebp - 0x120]
push eax
mov ecx, 0x668008
mov edx, 0x668034
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.00648f98
mov edx, dword [ebp - 0x11c]
mov eax, 0x685908
call fcn.0040994c
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 4]
call fcn.00424b50
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 4]
call fcn.00409994
movzx eax, byte [0x6679e8]
push eax
lea eax, [ebp - 0x128]
push eax
mov ecx, 0x66804c
mov edx, 0x668064
mov eax, dword [ebp - 4]
call fcn.0042b81c
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 4]
call fcn.00409994
push dword [0x68592c]
push 0x66807c
push dword [ebp - 4]
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x12c]
mov dl, 1
call fcn.004241f0
test al, al
je 0x666869
push dword [0x68592c]
push 0x66808c
push dword [ebp - 4]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.0040a418
mov ecx, dword [ebp - 0x130]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a8dc
mov dword [0x6858e0], eax
mov ecx, 0x66809c
mov edx, 0x6680c8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x64]
test al, al
je 0x66685f
push 0
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x6680e4
mov edx, 0x668110
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x134]
mov eax, 0x685930
call fcn.0040994c
mov eax, dword [0x6858e0]
call fcn.004078f0
movzx eax, byte [0x6858e4]
and al, byte [0x6858ef]
je 0x6668e0
xor eax, eax
push ebp
push 0x6668d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x685978], eax
push 0x668120
push 0x668160
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x685970], eax
push 0x66817c
push 0x668160
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x685974], eax
push 0x685978
call dword [0x685970]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6668e0
mov eax, 0x6681c4
call fcn.0064688c
test ax, ax
jne 0x6668f9
mov eax, dword [0x68589c]
call fcn.006618d8
push 0
mov ecx, 0x6681d8
mov edx, 0x66820c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x666928
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3b8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x84]
push 0
mov ecx, 0x668224
mov edx, 0x668240
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6669da
push 0
mov ecx, 0x668258
mov edx, 0x668288
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6669da
lea eax, [ebp - 0x138]
mov ecx, 0x6682a0
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x138]
mov dl, 1
call fcn.004241f0
test al, al
je 0x6669da
lea eax, [ebp - 0x13c]
mov ecx, 0x6682c8
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x13c]
mov dl, 1
call fcn.004241f0
test al, al
je 0x6669da
push 1
mov eax, dword [0x685904]
call fcn.0040a13c
push eax
push 0x6682e4
push 0x6682ec
push 0x668308
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.shell32.dll_ShellExecuteW
mov eax, 0x685910
call fcn.0040956c
push 0
mov ecx, 0x668320
mov edx, 0x668338
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666d7b
push 0
mov ecx, 0x668350
mov edx, 0x66836c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666b38
xor eax, eax
push ebp
push 0x666b2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov al, 0x30
call fcn.00646c70
lea eax, [ebp - 0x140]
push eax
mov ecx, 2
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.0040a500
mov eax, dword [ebp - 0x140]
call fcn.00423824
push eax
lea eax, [ebp - 0x144]
push eax
mov ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.0040a500
mov eax, dword [ebp - 0x144]
call fcn.00423824
push eax
lea eax, [ebp - 0x14c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a500
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
mov edx, 0x668384
call fcn.0040a390
mov eax, dword [ebp - 0x148]
call fcn.00423824
pop edx
pop ecx
call fcn.00426c84
fstp qword [ebp - 0x20]
wait
call fcn.00426e74
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004f7148
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
jle 0x666b24
push 0x30
lea edx, [ebp - 0x150]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x150]
call fcn.0040a13c
push eax
push 0x66838c
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
mov eax, 1
call fcn.006636f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x666b38
push 0
mov ecx, 0x668544
mov edx, 0x668568
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x666caf
push 0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x668580
mov edx, 0x6685a8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 0x6685c0
call fcn.0040a390
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00648f98
mov edx, dword [ebp - 0x154]
mov eax, 0x685910
call fcn.0040994c
mov dl, 1
mov eax, dword [0x685910]
call fcn.004241f0
test al, al
jne 0x666caf
cmp byte [0x6858e6], 0
jne 0x666ca5
push 0x30
lea edx, [ebp - 0x160]
mov eax, dword [0x68589c]
call fcn.005418c8
mov eax, dword [ebp - 0x160]
call fcn.0040a13c
push eax
push 0
lea eax, [ebp - 0x168]
push eax
mov ecx, 0x6685e8
mov edx, 0x6685fc
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
mov edx, dword [0x685910]
call fcn.00649bf8
mov eax, dword [ebp - 0x164]
call fcn.0040a13c
push eax
mov eax, dword [0x68589c]
call fcn.0054aaec
push eax
call sub.user32.dll_MessageBoxW
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3ec]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x666c73
lea edx, [ebp - 0x16c]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3ec]
call fcn.00585748
mov eax, dword [ebp - 0x16c]
mov dl, 1
call fcn.004241f0
test al, al
jne 0x666c7d
mov eax, 0xb
call fcn.006636f8
lea edx, [ebp - 0x170]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3ec]
call fcn.00585748
mov edx, dword [ebp - 0x170]
mov eax, 0x685910
call fcn.0040994c
jmp 0x666caf
mov eax, 0xb
call fcn.006636f8
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x66861c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x120]
dec eax
test eax, eax
jl 0x666d7b
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x178]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x178]
mov edx, 0x66863c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x174]
mov dx, 1
mov eax, dword [0x68589c]
call fcn.006538b8
cmp byte [0x68594d], 0
je 0x666d6f
cmp byte [0x6858e4], 0
je 0x666d65
mov eax, dword [0x685978]
push eax
call dword [0x685974]
mov eax, 1
call fcn.006636f8
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x666cf6
cmp byte [0x6858e4], 0
je 0x666db2
xor eax, eax
push ebp
push 0x666da8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x685978]
push eax
call dword [0x685974]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x666db2
push 0
mov ecx, 0x66865c
mov edx, 0x66868c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, 3
je 0x666ddc
mov eax, 0x6686a4
call fcn.0064688c
test ax, ax
jbe 0x666e0a
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x84]
push 0
mov ecx, 0x6686bc
mov edx, 0x6686f0
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x666e39
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3b8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x84]
push 1
mov ecx, 0x668708
mov edx, 0x668730
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jle 0x666ed6
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e0]
call fcn.00541f2c
push 1
mov ecx, 0x668748
mov edx, 0x668770
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp eax, 2
jne 0x666e9c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e0]
mov edx, 1
call fcn.0058ee54
jmp 0x666eb0
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e0]
xor edx, edx
call fcn.0058ee54
mov eax, 0x668788
call fcn.0064688c
test ax, ax
jbe 0x666ed6
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e0]
mov edx, 1
call fcn.0058ee54
push 0
mov ecx, 0x6687a0
mov edx, 0x6687cc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666f19
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
call fcn.00541f2c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x108]
push 0
mov ecx, 0x6687e4
mov edx, 0x66880c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x666ff0
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3dc]
call fcn.00541f2c
push 0
mov ecx, 0x668824
mov edx, 0x668854
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov edx, eax
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3dc]
mov ecx, dword [eax]
call dword [ecx + 0x108]
lea edx, [ebp - 4]
mov eax, 0x66886c
call fcn.00648f98
mov eax, dword [ebp - 4]
cmp eax, 0x6688a0
jne 0x666f91
mov al, 1
jmp 0x666fb6
cmp dword [ebp - 4], 0
je 0x666fa0
mov eax, 0x6688d4
test eax, eax
jne 0x666fa4
xor eax, eax
jmp 0x666fb6
mov edx, 0x668908
mov eax, dword [ebp - 4]
call fcn.004229c4
test eax, eax
sete al
test al, al
jne 0x666ff0
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
call fcn.00422824
mov eax, dword [ebp - 0x17c]
mov edx, 0x66893c
call fcn.0040a4c8
sete dl
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3dc]
mov ecx, dword [eax]
call dword [ecx + 0x108]
push 0
mov ecx, 0x668950
mov edx, 0x66897c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x667060
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e4]
call fcn.00541f2c
push 0x668994
lea eax, [ebp - 0x184]
push eax
mov ecx, 0x6689a8
mov edx, 0x6689dc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00648f98
mov eax, dword [ebp - 0x180]
or edx, 0xffffffff
call fcn.00423860
mov dword [0x6858fc], eax
push 0
mov ecx, 0x6689f4
mov edx, 0x668a24
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6672ff
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ec]
call fcn.00541f2c
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x668a3c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x120]
dec eax
test eax, eax
jl 0x6672cb
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 0x14]
call fcn.004235b4
mov ecx, dword [ebp - 0x188]
mov edx, 0x668a60
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 4], 0
je 0x6672bf
lea eax, [ebp - 0x190]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668a84
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a500
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.00648f98
mov edx, dword [ebp - 0x18c]
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x2a0]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
cmp byte [0x685948], 0
jne 0x6672bf
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668a98
call fcn.0040a710
mov ecx, eax
inc ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668aac
call fcn.0040a710
mov ecx, eax
inc ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668ac0
call fcn.0040a710
mov ecx, eax
inc ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668ad4
call fcn.0040a710
mov ecx, eax
inc ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040a548
xor eax, eax
push ebp
push 0x6672b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668ae8
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a500
mov eax, dword [ebp - 0x194]
call fcn.00656bf8
push eax
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov ebx, dword [eax + 0x3f0]
mov eax, dword [ebx + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, ebx
pop ecx
call fcn.00640174
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668afc
call fcn.0040a710
mov ecx, eax
inc ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.0040a548
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov ebx, dword [eax + 0x3f0]
mov eax, dword [ebx + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
push eax
mov eax, dword [ebp - 4]
call fcn.00656bf8
mov ecx, eax
mov eax, ebx
pop edx
call fcn.00640140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6672bf
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x6670d7
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 5
jle 0x6672ff
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ec]
mov edx, 0xc8
call fcn.00540f14
push 0
mov ecx, 0x668b10
mov edx, 0x668b3c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6673c3
lea edx, [ebp - 4]
mov eax, 0x668b54
call fcn.00648f98
mov eax, dword [ebp - 4]
mov edx, 0x668b7c
call fcn.0040a4c8
je 0x66734e
mov eax, dword [0x67f2b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c0]
mov edx, dword [ebp - 4]
call fcn.0054191c
lea edx, [ebp - 4]
mov eax, 0x668ba4
call fcn.00648f98
mov eax, dword [ebp - 4]
mov edx, 0x668bd4
call fcn.0040a4c8
je 0x667392
lea edx, [ebp - 0x198]
mov eax, 0x668c04
call fcn.00648f98
mov edx, dword [ebp - 0x198]
mov eax, dword [0x67f2b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
call fcn.0054191c
lea edx, [ebp - 4]
mov eax, 0x668c34
call fcn.00648f98
mov eax, dword [ebp - 4]
mov edx, 0x668c68
call fcn.0040a4c8
je 0x6673c3
mov eax, dword [0x67f2b4]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c8]
mov edx, dword [ebp - 4]
call fcn.0054191c
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x668c9c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov edx, dword [eax]
call dword [edx + 0x120]
dec eax
test eax, eax
jl 0x66751e
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1a0]
mov eax, dword [0x68589c]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1a0]
mov edx, 0x668cbc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 4]
call fcn.00422824
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668cdc
call fcn.0040a710
test eax, eax
jle 0x667494
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3cc]
call fcn.00541f2c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3cc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x108]
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
cmp byte [eax + 0x69], 0
jne 0x667512
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668cfc
call fcn.0040a710
test eax, eax
jg 0x6674e9
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668d24
call fcn.0040a710
test eax, eax
jg 0x6674e9
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x668d4c
call fcn.0040a710
test eax, eax
jle 0x667512
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
call fcn.00541f2c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d0]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x108]
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x66740a
mov edx, 0x668d70
mov eax, dword [0x6858d8]
call fcn.0050947c
test al, al
je 0x66755a
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
call fcn.00541f2c
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x108]
call fcn.0065dab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667662
lea eax, [ebp - 0x1a0]
mov edx, 0xc
call fcn.004095cc
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x160]
call fcn.0040956c
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x150]
call fcn.0040956c
lea eax, [ebp - 0x14c]
mov edx, 0x10
call fcn.004095cc
lea eax, [ebp - 0x10c]
call fcn.0040956c
lea eax, [ebp - 0x108]
mov edx, 0x15
call fcn.004095cc
lea eax, [ebp - 0xb4]
call fcn.0040956c
lea eax, [ebp - 0xb0]
mov edx, 8
call fcn.004095cc
lea eax, [ebp - 0x90]
call fcn.0040956c
lea eax, [ebp - 0x8c]
mov edx, 7
call fcn.004095cc
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x4c]
mov edx, 0xa
call fcn.004095cc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004095cc
ret