Function at 0x659bb8
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27e
push 0
push 0
dec ecx
jne 0x659bc0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x659a1c]
call fcn.0040a96c
lea eax, [ebp - 0x52]
mov edx, dword [0x61d734]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x65d470
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x68b8e6], 1
mov byte [0x68b8e5], 0
mov byte [0x68b8e4], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3c8]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b8]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3bc]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3cc]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d0]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d4]
call fcn.00541f2c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d8]
call fcn.00541f2c
push 0x65d48c
lea eax, [ebp - 0x1098]
push eax
mov ecx, 0x65d4b4
mov edx, 0x65d4c8
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1098]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
push 0x65d4e4
lea eax, [ebp - 0x10a0]
push eax
mov ecx, 0x65d510
mov edx, 0x65d520
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10a0]
lea edx, [ebp - 0x109c]
call fcn.00649348
mov edx, dword [ebp - 0x109c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3c0]
call fcn.00541924
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
xor edx, edx
call fcn.0057651c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.00541f34
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
lea edx, [ebp - 0x10a8]
mov eax, dword [0x68b92c]
call fcn.00422c30
mov eax, dword [ebp - 0x10a8]
lea edx, [ebp - 0x10a4]
call fcn.0042b5ec
mov edx, dword [ebp - 0x10a4]
mov eax, 0x68b92c
call fcn.0040994c
push 0
lea eax, [ebp - 0x10b0]
push eax
mov ecx, 0x65d53c
mov edx, 0x65d558
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10b0]
lea edx, [ebp - 0x10ac]
call fcn.00649348
mov edx, dword [ebp - 0x10ac]
mov eax, 0x68b904
call fcn.0040994c
mov dl, 1
mov eax, dword [0x48fe5c]
call fcn.004b380c
mov dword [0x68b954], eax
xor eax, eax
mov dword [0x68b95c], eax
xor eax, eax
mov dword [0x68b960], eax
xor eax, eax
mov dword [0x68b964], eax
xor eax, eax
mov dword [0x68b968], eax
xor eax, eax
mov dword [0x68b96c], eax
cmp byte [0x68b949], 0
je 0x659f6e
push dword [0x68b92c]
push 0x65d570
push dword [0x68b940]
lea eax, [ebp - 0x10b4]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10b4]
mov dl, 1
call fcn.004241f0
test al, al
je 0x659f6e
push 0
lea eax, [ebp - 0x10b8]
mov ecx, 0x65d580
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x10b8]
call fcn.0040a13c
push eax
push dword [0x68b92c]
push 0x65d5ac
push dword [0x68b940]
lea eax, [ebp - 0x10bc]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10bc]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x659f39
lea eax, [ebp - 0x10c0]
mov ecx, 0x65d5bc
mov edx, dword [0x68b900]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c0]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a8dc
mov dword [0x68b8d8], eax
mov ecx, dword [0x68b954]
mov edx, 0x65d5e8
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68b95c], eax
mov ecx, dword [0x68b954]
mov edx, 0x65d600
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68b960], eax
mov ecx, dword [0x68b954]
mov edx, 0x65d61c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68b964], eax
mov ecx, dword [0x68b954]
mov edx, 0x65d644
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68b968], eax
mov ecx, dword [0x68b954]
mov edx, 0x65d670
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68b96c], eax
jmp 0x659fa1
call fcn.00430958
push eax
lea eax, [ebp - 0x10c4]
mov ecx, 0x65d690
mov edx, dword [0x68b900]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c4]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a914
mov dword [0x68b8d8], eax
jmp 0x659fa1
call fcn.00430958
push eax
lea eax, [ebp - 0x10c8]
mov ecx, 0x65d6bc
mov edx, dword [0x68b900]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c8]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a914
mov dword [0x68b8d8], eax
push 0
mov ecx, 0x65d6e8
mov edx, 0x65d70c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x659fd9
push 0
mov ecx, 0x65d724
mov edx, 0x65d74c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
je 0x65abe7
lea edx, [ebp - 0x10cc]
mov al, 0x1c
call fcn.00646d44
mov eax, dword [ebp - 0x10cc]
push eax
mov ecx, 0x65d764
mov edx, 0x65d780
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x10d0]
mov al, 0x1d
call fcn.00646d44
mov eax, dword [ebp - 0x10d0]
push eax
mov ecx, 0x65d79c
mov edx, 0x65d7c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10d8]
push eax
mov ecx, 0x65d7dc
mov edx, 0x65d7ec
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10d8]
lea edx, [ebp - 0x10d4]
call fcn.00649348
mov eax, dword [ebp - 0x10d4]
push eax
mov ecx, 0x65d80c
mov edx, 0x65d81c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
lea eax, [ebp - 8]
call fcn.0040956c
push 0
mov ecx, 0x65d83c
mov edx, 0x65d858
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65a0fd
push 0
mov ecx, 0x65d870
mov edx, 0x65d888
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jmp 0x65a0fd
push 0
lea eax, [ebp - 0x10e4]
push eax
mov ecx, 0x65d9ec
mov edx, 0x65d9fc
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x10e0]
call fcn.00649348
mov ecx, dword [ebp - 0x10e0]
lea eax, [ebp - 0x10dc]
mov edx, dword [ebp - 8]
call fcn.0040a390
mov eax, dword [ebp - 0x10dc]
push eax
mov ecx, 0x65da1c
mov edx, 0x65da2c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10ec]
push eax
mov ecx, 0x65da4c
mov edx, 0x65da5c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10ec]
lea edx, [ebp - 0x10e8]
call fcn.00649348
mov eax, dword [ebp - 0x10e8]
push eax
mov ecx, 0x65da7c
mov edx, 0x65da8c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f4]
push eax
mov ecx, 0x65daac
mov edx, 0x65dabc
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f4]
lea edx, [ebp - 0x10f0]
call fcn.00649348
mov eax, dword [ebp - 0x10f0]
push eax
mov ecx, 0x65dadc
mov edx, 0x65daec
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10fc]
push eax
mov ecx, 0x65db0c
mov edx, 0x65db1c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10fc]
lea edx, [ebp - 0x10f8]
call fcn.00649348
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, 0x65db3c
mov edx, 0x65db4c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1104]
push eax
mov ecx, 0x65db6c
mov edx, 0x65db7c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1104]
lea edx, [ebp - 0x1100]
call fcn.00649348
mov eax, dword [ebp - 0x1100]
push eax
mov ecx, 0x65db9c
mov edx, 0x65dbac
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x65dbcc
mov edx, 0x65dbdc
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x110c]
lea edx, [ebp - 0x1108]
call fcn.00649348
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x65dbfc
mov edx, 0x65dc0c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x65dc2c
mov edx, 0x65dc3c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00649348
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x65dc5c
mov edx, 0x65dc6c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x111c]
push eax
mov ecx, 0x65dc8c
mov edx, 0x65dc9c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x111c]
lea edx, [ebp - 0x1118]
call fcn.00649348
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x65dcbc
mov edx, 0x65dccc
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1124]
push eax
mov ecx, 0x65dcec
mov edx, 0x65dcfc
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00649348
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, 0x65dd1c
mov edx, 0x65dd2c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x112c]
push eax
mov ecx, 0x65dd4c
mov edx, 0x65dd5c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.00649348
mov eax, dword [ebp - 0x1128]
push eax
mov ecx, 0x65dd78
mov edx, 0x65dd88
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1134]
push eax
mov ecx, 0x65dda4
mov edx, 0x65ddb4
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1134]
lea edx, [ebp - 0x1130]
call fcn.00649348
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x65ddd0
mov edx, 0x65dde0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x113c]
push eax
mov ecx, 0x65ddfc
mov edx, 0x65de0c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x113c]
lea edx, [ebp - 0x1138]
call fcn.00649348
mov eax, dword [ebp - 0x1138]
push eax
mov ecx, 0x65de28
mov edx, 0x65de38
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1144]
push eax
mov ecx, 0x65de54
mov edx, 0x65de64
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1144]
lea edx, [ebp - 0x1140]
call fcn.00649348
mov eax, dword [ebp - 0x1140]
push eax
mov ecx, 0x65de80
mov edx, 0x65de90
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x114c]
push eax
mov ecx, 0x65deac
mov edx, 0x65debc
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x114c]
lea edx, [ebp - 0x1148]
call fcn.00649348
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65ded8
mov edx, 0x65dee8
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1154]
push eax
mov ecx, 0x65df04
mov edx, 0x65df14
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1154]
lea edx, [ebp - 0x1150]
call fcn.00649348
mov eax, dword [ebp - 0x1150]
push eax
mov ecx, 0x65df30
mov edx, 0x65df40
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x65df5c
mov edx, 0x65df6c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00649348
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65df88
mov edx, 0x65df98
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1164]
push eax
mov ecx, 0x65dfb4
mov edx, 0x65dfc4
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00649348
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x65dfe0
mov edx, 0x65dff0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x116c]
push eax
mov ecx, 0x65e00c
mov edx, 0x65e01c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x116c]
lea edx, [ebp - 0x1168]
call fcn.00649348
mov eax, dword [ebp - 0x1168]
push eax
mov ecx, 0x65e038
mov edx, 0x65e048
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1174]
push eax
mov ecx, 0x65e064
mov edx, 0x65e074
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1174]
lea edx, [ebp - 0x1170]
call fcn.00649348
mov eax, dword [ebp - 0x1170]
push eax
mov ecx, 0x65e090
mov edx, 0x65e0a0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x117c]
push eax
mov ecx, 0x65e0bc
mov edx, 0x65e0d0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x117c]
lea edx, [ebp - 0x1178]
call fcn.00649348
mov eax, dword [ebp - 0x1178]
push eax
mov ecx, 0x65e0ec
mov edx, 0x65e100
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1184]
push eax
mov ecx, 0x65e11c
mov edx, 0x65e130
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1184]
lea edx, [ebp - 0x1180]
call fcn.00649348
mov eax, dword [ebp - 0x1180]
push eax
mov ecx, 0x65e14c
mov edx, 0x65e160
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x65e17c
mov edx, 0x65e190
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x118c]
lea edx, [ebp - 0x1188]
call fcn.00649348
mov eax, dword [ebp - 0x1188]
push eax
mov ecx, 0x65e1ac
mov edx, 0x65e1c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65e1dc
mov edx, 0x65e1f0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00649348
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x65e20c
mov edx, 0x65e220
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x119c]
push eax
mov ecx, 0x65e23c
mov edx, 0x65e250
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x119c]
lea edx, [ebp - 0x1198]
call fcn.00649348
mov eax, dword [ebp - 0x1198]
push eax
mov ecx, 0x65e26c
mov edx, 0x65e280
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11a4]
push eax
mov ecx, 0x65e29c
mov edx, 0x65e2b0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11a4]
lea edx, [ebp - 0x11a0]
call fcn.00649348
mov eax, dword [ebp - 0x11a0]
push eax
mov ecx, 0x65e2cc
mov edx, 0x65e2e0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65e2fc
mov edx, 0x65e310
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ac]
lea edx, [ebp - 0x11a8]
call fcn.00649348
mov eax, dword [ebp - 0x11a8]
push eax
mov ecx, 0x65e32c
mov edx, 0x65e340
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11b4]
push eax
mov ecx, 0x65e35c
mov edx, 0x65e370
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11b0]
call fcn.00649348
mov eax, dword [ebp - 0x11b0]
push eax
mov ecx, 0x65e38c
mov edx, 0x65e3a0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11bc]
push eax
mov ecx, 0x65e3bc
mov edx, 0x65e3d0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11bc]
lea edx, [ebp - 0x11b8]
call fcn.00649348
mov eax, dword [ebp - 0x11b8]
push eax
mov ecx, 0x65e3ec
mov edx, 0x65e400
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11c4]
push eax
mov ecx, 0x65e41c
mov edx, 0x65e430
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11c4]
lea edx, [ebp - 0x11c0]
call fcn.00649348
mov eax, dword [ebp - 0x11c0]
push eax
mov ecx, 0x65e44c
mov edx, 0x65e460
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11cc]
push eax
mov ecx, 0x65e47c
mov edx, 0x65e490
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11cc]
lea edx, [ebp - 0x11c8]
call fcn.00649348
mov eax, dword [ebp - 0x11c8]
push eax
mov ecx, 0x65e4ac
mov edx, 0x65e4c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11d4]
push eax
mov ecx, 0x65e4dc
mov edx, 0x65e4f0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d4]
lea edx, [ebp - 0x11d0]
call fcn.00649348
mov eax, dword [ebp - 0x11d0]
push eax
mov ecx, 0x65e50c
mov edx, 0x65e520
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11dc]
push eax
mov ecx, 0x65e53c
mov edx, 0x65e550
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11dc]
lea edx, [ebp - 0x11d8]
call fcn.00649348
mov eax, dword [ebp - 0x11d8]
push eax
mov ecx, 0x65e56c
mov edx, 0x65e580
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11e4]
push eax
mov ecx, 0x65e59c
mov edx, 0x65e5b0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e4]
lea edx, [ebp - 0x11e0]
call fcn.00649348
mov eax, dword [ebp - 0x11e0]
push eax
mov ecx, 0x65e5cc
mov edx, 0x65e5e0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11ec]
push eax
mov ecx, 0x65e5fc
mov edx, 0x65e610
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ec]
lea edx, [ebp - 0x11e8]
call fcn.00649348
mov eax, dword [ebp - 0x11e8]
push eax
mov ecx, 0x65e62c
mov edx, 0x65e640
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11f4]
push eax
mov ecx, 0x65e65c
mov edx, 0x65e670
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11f4]
lea edx, [ebp - 0x11f0]
call fcn.00649348
mov eax, dword [ebp - 0x11f0]
push eax
mov ecx, 0x65e68c
mov edx, 0x65e6a0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11fc]
push eax
mov ecx, 0x65e6bc
mov edx, 0x65e6d0
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11fc]
lea edx, [ebp - 0x11f8]
call fcn.00649348
mov eax, dword [ebp - 0x11f8]
push eax
mov ecx, 0x65e6ec
mov edx, 0x65e700
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1204]
push eax
mov ecx, 0x65e71c
mov edx, 0x65e730
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1204]
lea edx, [ebp - 0x1200]
call fcn.00649348
mov eax, dword [ebp - 0x1200]
push eax
mov ecx, 0x65e74c
mov edx, 0x65e760
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x120c]
push eax
mov ecx, 0x65e77c
mov edx, 0x65e790
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x120c]
lea edx, [ebp - 0x1208]
call fcn.00649348
mov eax, dword [ebp - 0x1208]
push eax
mov ecx, 0x65e7ac
mov edx, 0x65e7c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x1210]
mov al, 0x37
call fcn.00646d44
mov eax, dword [ebp - 0x1210]
push eax
mov ecx, 0x65e7dc
mov edx, 0x65e7f4
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
movzx eax, byte [0x68b8e3]
push eax
mov ecx, 0x65e810
mov edx, 0x65e834
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x68b8e0]
push eax
mov ecx, 0x65e850
mov edx, 0x65e868
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x68b8dc]
push eax
mov ecx, 0x65e884
mov edx, 0x65e898
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [0x68b92c]
push eax
mov ecx, 0x65e8b4
mov edx, 0x65e8d8
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [0x68b904], 0
je 0x65aca0
mov eax, dword [0x68b904]
push eax
mov ecx, 0x65e8f4
mov edx, 0x65e920
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [0x68b930]
push eax
mov ecx, 0x65e93c
mov edx, 0x65e968
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x68b8dd], 0
je 0x65af19
push 0
mov ecx, 0x65e984
mov edx, 0x65e9b0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65e9c8
mov edx, 0x65e9ec
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65ea08
mov edx, 0x65ea34
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65ea4c
mov edx, 0x65ea78
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65ea94
mov edx, 0x65eac4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65eadc
mov edx, 0x65eb0c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65eb28
mov edx, 0x65eb58
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65adad
push 0
lea eax, [ebp - 0x1218]
push eax
mov ecx, 0x65eb70
mov edx, 0x65ebb0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1218]
lea edx, [ebp - 0x1214]
call fcn.00649348
mov eax, dword [ebp - 0x1214]
push eax
mov ecx, 0x65ebc8
mov edx, 0x65ec08
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x65adc3
push 0
mov ecx, 0x65ec24
mov edx, 0x65ec64
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65ec80
mov edx, 0x65ecb4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65ae28
push 0
lea eax, [ebp - 0x1220]
push eax
mov ecx, 0x65eccc
mov edx, 0x65ecf4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1220]
lea edx, [ebp - 0x121c]
call fcn.00649348
mov eax, dword [ebp - 0x121c]
push eax
mov ecx, 0x65ed0c
mov edx, 0x65ed34
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x65ae3e
push 0
mov ecx, 0x65ed50
mov edx, 0x65ed78
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65ed94
mov edx, 0x65edbc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65edd4
mov edx, 0x65edfc
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65ee18
mov edx, 0x65ee48
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65af19
push 0
lea eax, [ebp - 0x1228]
push eax
mov ecx, 0x65ee60
mov edx, 0x65ee98
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1228]
lea edx, [ebp - 0x1224]
call fcn.00649348
mov eax, dword [ebp - 0x1224]
push eax
mov ecx, 0x65eeb0
mov edx, 0x65eed0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1230]
push eax
mov ecx, 0x65eeec
mov edx, 0x65ef24
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1230]
lea edx, [ebp - 0x122c]
call fcn.00649348
mov eax, dword [ebp - 0x122c]
push eax
mov ecx, 0x65ef3c
mov edx, 0x65ef64
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65ef80
mov edx, 0x65ef9c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b270
push 0
lea eax, [ebp - 0x1238]
push eax
mov ecx, 0x65efb4
mov edx, 0x65efd4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1238]
lea edx, [ebp - 0x1234]
call fcn.00649348
mov eax, dword [ebp - 0x1234]
push eax
mov ecx, 0x65efec
mov edx, 0x65f00c
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65f028
mov edx, 0x65f050
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b270
push 1
mov ecx, 0x65f068
mov edx, 0x65f090
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f0ac
mov edx, 0x65f0dc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f0f4
mov edx, 0x65f124
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f140
mov edx, 0x65f174
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f18c
mov edx, 0x65f1c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f1dc
mov edx, 0x65f20c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f224
mov edx, 0x65f254
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f270
mov edx, 0x65f2a0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f2b8
mov edx, 0x65f2e8
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f304
mov edx, 0x65f330
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f348
mov edx, 0x65f374
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f390
mov edx, 0x65f3bc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b102
push 0xffffffffffffffff
mov ecx, 0x65f3d4
mov edx, 0x65f400
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push eax
mov ecx, 0x65f418
mov edx, 0x65f444
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
mov ecx, 0x65f460
mov edx, 0x65f490
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b118
push 1
mov ecx, 0x65f4a8
mov edx, 0x65f4d8
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x65b118
push 0
mov ecx, 0x65f4f4
mov edx, 0x65f520
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
mov ecx, 0x65f53c
mov edx, 0x65f570
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b148
push 1
mov ecx, 0x65f588
mov edx, 0x65f5bc
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f5d8
mov edx, 0x65f614
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65f62c
mov edx, 0x65f668
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65f684
mov edx, 0x65f6c0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b1b8
push 0
mov ecx, 0x65f6d8
mov edx, 0x65f708
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push eax
mov ecx, 0x65f720
mov edx, 0x65f750
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
lea eax, [ebp - 0x1240]
push eax
mov ecx, 0x65f76c
mov edx, 0x65f79c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1240]
lea edx, [ebp - 0x123c]
call fcn.00649348
mov eax, dword [ebp - 0x123c]
push eax
mov ecx, 0x65f7b4
mov edx, 0x65f7e4
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1244]
push eax
mov ecx, 0x65f800
mov edx, 0x65f830
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0x1244], 0
je 0x65b270
push 0
lea eax, [ebp - 0x124c]
push eax
mov ecx, 0x65f848
mov edx, 0x65f878
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x124c]
lea edx, [ebp - 0x1248]
call fcn.00649348
mov eax, dword [ebp - 0x1248]
push eax
mov ecx, 0x65f890
mov edx, 0x65f8c0
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov byte [0x68b94e], 0
push 0
mov ecx, 0x65f8dc
mov edx, 0x65f908
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
jne 0x65b2a8
mov dl, 1
mov eax, dword [0x68b92c]
call fcn.00424288
test al, al
je 0x65b2a8
mov byte [0x68b94e], 1
cmp byte [0x68b8dc], 0
je 0x65b319
xor eax, eax
push ebp
push 0x65b30f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x68b978], eax
push 0x65f914
push 0x65f954
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x68b970], eax
push 0x65f970
push 0x65f954
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x68b974], eax
push 0x68b978
call dword [0x68b970]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b319
push 0x1f4
call sub.kernel32.dll_Sleep_2
push 0x65f9b8
lea eax, [ebp - 0x1250]
push eax
mov ecx, 0x65f9ec
mov edx, 0x65fa00
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1250]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
xor eax, eax
push ebp
push 0x65b3e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x1254]
xor eax, eax
call fcn.00406c04
mov ecx, dword [ebp - 0x1254]
mov dl, 1
mov eax, dword [0x492cec]
call fcn.004b5ea0
mov dword [0x68b89c], eax
mov eax, dword [0x68b8c8]
xor edx, edx
push edx
push eax
mov eax, dword [0x68b89c]
call fcn.004b38d8
push 0xff00
lea eax, [ebp - 0x1258]
mov ecx, 0x65fa1c
mov edx, dword [0x68b900]
call fcn.0040a390
mov ecx, dword [ebp - 0x1258]
mov dl, 1
mov eax, dword [0x492cec]
call fcn.004b5ea0
mov dword [0x68b8a0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b444
xor esi, esi
mov eax, dword [0x68b8cc]
sub eax, esi
cmp eax, 0x1000
jb 0x65b46d
lea edx, [ebp - 0x1094]
mov ecx, 0x1000
mov eax, dword [0x68b89c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x65b487
mov ecx, dword [0x68b8cc]
sub ecx, esi
lea edx, [ebp - 0x1094]
mov eax, dword [0x68b89c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x1094]
mov ecx, ebx
mov eax, dword [0x68b8a0]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x68b8cc]
mov dword [ebp - 0x1260], eax
xor eax, eax
mov dword [ebp - 0x125c], eax
fild qword [ebp - 0x1260]
fdivr dword [0x65fa3c]
mov dword [ebp - 0x1260], esi
xor eax, eax
mov dword [ebp - 0x125c], eax
fild qword [ebp - 0x1260]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.0057651c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.00541f78
cmp ebx, 0x1000
je 0x65b446
mov eax, dword [0x68b8a0]
call fcn.004078f0
mov eax, dword [0x68b89c]
call fcn.004078f0
push 0x65fa4c
lea eax, [ebp - 0x1264]
push eax
mov ecx, 0x65fa7c
mov edx, 0x65fa8c
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1264]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov dl, 1
mov eax, dword [0x61da84]
call fcn.00623bd4
mov dword [0x68b8a4], eax
xor eax, eax
push ebp
push 0x65b5a4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1268]
mov ecx, 0x65faa8
mov edx, dword [0x68b900]
call fcn.0040a390
mov edx, dword [ebp - 0x1268]
mov cl, 1
mov eax, dword [0x68b8a4]
call fcn.00623c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b602
mov dl, 1
mov eax, dword [0x48fe5c]
call fcn.004b380c
mov dword [ebp - 4], eax
mov byte [ebp - 0x71], 0
mov eax, 0x65fad4
call fcn.00646680
xor al, 1
mov byte [ebp - 0x70], al
push 0
mov ecx, 0x65fafc
mov edx, 0x65fb20
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x6c], eax
push 0
mov ecx, 0x65fb38
mov edx, 0x65fb64
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65b661
mov eax, 0x65fb7c
call fcn.0058a07c
mov byte [0x68b8e8], 0
mov byte [0x68b8e9], 0
lea eax, [ebp - 0x10]
call fcn.0040956c
push 0
mov ecx, 0x65fbd0
mov edx, 0x65fbf4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x68b8ec], eax
push 0
mov ecx, 0x65fc0c
mov edx, 0x65fc30
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x68b8f0], eax
mov eax, dword [0x6857c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ec]
cmp byte [eax + 0x69], 0
je 0x65b7d5
mov eax, dword [0x6857c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65b7d5
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
mov eax, dword [0x6857c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov edx, dword [ebp - 0x60]
call fcn.00640b28
test al, al
jne 0x65b7c9
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.00659860
cmp dword [ebp - 8], 0
je 0x65b7c9
lea edx, [ebp - 0x126c]
mov eax, dword [ebp - 8]
call fcn.00422824
mov edx, dword [ebp - 0x126c]
lea eax, [ebp - 8]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, 0x65fc48
call fcn.0040a4c8
jne 0x65b75b
mov byte [0x68b8e8], 1
jmp 0x65b7c9
mov eax, dword [ebp - 8]
mov edx, 0x65fc6c
call fcn.0040a4c8
jne 0x65b773
mov byte [0x68b8e9], 1
jmp 0x65b7c9
mov eax, dword [ebp - 8]
mov edx, 0x65fc90
call fcn.0040a4c8
jne 0x65b792
mov byte [0x68b8e8], 1
mov byte [0x68b8e9], 1
jmp 0x65b7c9
mov eax, dword [ebp - 8]
mov edx, 0x65fcb0
call fcn.0040a4c8
jne 0x65b7b1
mov byte [0x68b8e8], 1
mov byte [0x68b8e9], 1
jmp 0x65b7c9
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65fcd4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040a418
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65b6f0
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x6f]
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x65c40d
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68b8e5], 0
je 0x65b804
push ebp
call fcn.00659a7c
pop ecx
cmp byte [0x68b8e8], 0
je 0x65b81c
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68b8ec]
jl 0x65c401
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1270]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x1270]
mov edx, 0x65fce4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 8], 0
je 0x65c401
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65fcfc
call fcn.0040a710
test eax, eax
je 0x65c401
push 0x65fd0c
push dword [0x68b920]
push 0x65fd34
lea eax, [ebp - 0x1274]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1274]
mov eax, dword [ebp - 8]
call fcn.0040a4c8
je 0x65c401
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65fd48
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
cmp byte [0x68b8e9], 0
je 0x65b8ea
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68b8ec]
jl 0x65b8ea
mov eax, dword [ebp - 0x1c]
mov edx, 0x65fd58
call fcn.0040a4c8
jne 0x65c401
cmp byte [ebp - 0x6f], 0
je 0x65b99e
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00409994
jmp 0x65b97b
lea eax, [ebp - 0x1278]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65fd98
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1278]
push eax
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x1c]
call fcn.00422824
mov edx, dword [ebp - 0x127c]
mov ecx, 1
pop eax
call fcn.0040a710
test eax, eax
jle 0x65b95a
mov bl, 1
jmp 0x65b995
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65fda8
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65fdb8
call fcn.0040a710
test eax, eax
jg 0x65b903
cmp bl, 1
je 0x65c401
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x1c]
call fcn.00649348
mov edx, dword [ebp - 0x1280]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65fdc8
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.0040a548
cmp dword [ebp - 0x1c], 0
jne 0x65b9e5
mov al, 1
jmp 0x65b9f7
mov eax, dword [ebp - 8]
test eax, eax
je 0x65b9f1
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setne al
test al, al
jne 0x65c401
lea eax, [ebp - 0x1284]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x1284]
mov edx, 1
call fcn.00423860
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65ba42
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65bd1d
fild dword [ebp - 0x6c]
fdivr dword [0x65fa3c]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.0057651c
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
xor eax, eax
push ebp
push 0x65bacb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1288]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x1288]
mov eax, dword [0x68b8a4]
call fcn.00625610
mov edx, eax
lea ecx, [ebp - 0x52]
mov eax, dword [0x68b8a4]
call fcn.00622b70
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bad5
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x65bd1d
cmp byte [0x68b8de], 0
je 0x65bafa
cmp byte [ebp - 0x18], 0
jne 0x65bafa
mov byte [ebp - 0x18], 2
cmp byte [ebp - 0x71], 0
jne case.0x65bb65.0
cmp byte [ebp - 0x18], 0
jne case.0x65bb65.0
push 0
push 0
lea eax, [ebp - 0x1290]
push eax
mov ecx, 0x65fdd8
mov edx, 0x65fdec
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1290]
lea ecx, [ebp - 0x128c]
mov edx, dword [ebp - 0x1c]
call fcn.00649fa8
mov eax, dword [ebp - 0x128c]
movzx ecx, word [0x65fe00]
xor edx, edx
call fcn.00589ee4
cmp eax, 0xe
ja case.0x65bb65.0
movzx eax, byte [eax + 0x65bb6c]
jmp dword [eax*4 + 0x65bb7b]
mov byte [ebp - 0x18], 1
jmp case.0x65bb65.0
mov byte [ebp - 0x18], 3
jmp case.0x65bb65.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x71], 1
jmp case.0x65bb65.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x71], 3
jmp case.0x65bb65.0
mov eax, dword [ebp - 0x58]
call fcn.0060d420
cmp byte [0x68b8e5], 0
je 0x65c401
mov eax, dword [0x68b8a4]
call fcn.004078f0
push ebp
call fcn.00659a7c
pop ecx
jmp 0x65c401
cmp byte [ebp - 0x18], 2
jne 0x65bcbc
xor eax, eax
push ebp
push 0x65bcae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x1294]
mov ecx, dword [0x68b900]
mov eax, dword [0x68b8a4]
call fcn.006241b0
push dword [0x68b900]
push 0x65fe10
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
push dword [ebp - 0x129c]
lea eax, [ebp - 0x1298]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1298]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00659298
test al, al
je 0x65bc66
mov byte [ebp - 0x18], 1
jmp 0x65bc6a
mov byte [ebp - 0x18], 3
push dword [0x68b900]
push 0x65fe20
lea edx, [ebp - 0x12a4]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
push dword [ebp - 0x12a4]
lea eax, [ebp - 0x12a0]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x12a0]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bcbc
cmp byte [ebp - 0x18], 1
je 0x65bcc8
cmp byte [ebp - 0x71], 1
jne 0x65bcf2
xor eax, eax
push ebp
push 0x65bce8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bcf2
cmp byte [ebp - 0x18], 3
je 0x65bcfe
cmp byte [ebp - 0x71], 3
jne 0x65bd1d
mov eax, 0x65fe30
call fcn.00646680
test al, al
jne 0x65c401
mov eax, dword [ebp - 0x1c]
call fcn.0065944c
jmp 0x65c401
mov ebx, 3
lea eax, [ebp - 0x12a8]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x12a8]
mov edx, 0x65fe60
call fcn.0040a4c8
jne 0x65bd86
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x65bd59
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65fe74
call fcn.0040a710
mov ebx, eax
add ebx, 3
mov byte [ebp - 0x6d], 0
mov dword [ebp - 0x88], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x65bdb3
mov eax, dword [ebp - 0x8c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x8c]
sub edx, eax
jl 0x65c0ac
inc edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x65c09d
lea eax, [ebp - 0x12ac]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x12ac]
mov dl, 1
call fcn.00424288
test al, al
jne 0x65c09d
xor eax, eax
push ebp
push 0x65be8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x12b0]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x12b0]
call fcn.004069bc
call fcn.00406960
cmp byte [0x68b8dd], 0
je 0x65be7d
cmp byte [ebp - 0x17], 0
je 0x65be7d
lea eax, [ebp - 0x12b4]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov edx, dword [ebp - 0x12b4]
mov eax, 0x65fe84
call fcn.0064b908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c09d
inc dword [ebp - 0x64]
dec dword [ebp - 0x84]
jne 0x65bdd1
cmp byte [ebp - 0x6d], 0
jne 0x65c401
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65c0c2
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65c401
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x65c1f6
lea edx, [ebp - 0x12e4]
mov eax, dword [ebp - 0x1c]
call fcn.00424b50
mov eax, dword [ebp - 0x12e4]
mov edx, 0x66002c
call fcn.0040a4c8
jne 0x65c133
push 1
push 0
push 0x660044
push 0x660088
push 0x660098
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004245bc
test eax, 1
jle 0x65c176
xor eax, eax
push ebp
push 0x65c16c
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x80
mov eax, dword [ebp - 0x1c]
call fcn.00424674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c176
lea edx, [ebp - 0x12ec]
mov eax, dword [ebp - 0x1c]
call fcn.00424b8c
mov eax, dword [ebp - 0x12ec]
lea edx, [ebp - 0x12e8]
call fcn.00422824
mov eax, dword [ebp - 0x12e8]
mov edx, 0x6600b0
call fcn.0040a4c8
je 0x65c1d8
lea edx, [ebp - 0x12f4]
mov eax, dword [ebp - 0x1c]
call fcn.00424b8c
mov eax, dword [ebp - 0x12f4]
lea edx, [ebp - 0x12f0]
call fcn.00422824
mov eax, dword [ebp - 0x12f0]
mov edx, 0x6600c8
call fcn.0040a4c8
jne 0x65c1f6
mov eax, dword [ebp - 0x1c]
call fcn.0065934c
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov byte [ebp - 0x6e], 0
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x65c232
xor eax, eax
push ebp
push 0x65c228
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c232
xor eax, eax
push ebp
push 0x65c270
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x12f8]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x12f8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x68b8a4]
call fcn.006241dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c371
cmp byte [ebp - 0x6e], 0
jne 0x65c1f6
cmp byte [ebp - 0x70], 0
je 0x65c3cc
xor eax, eax
push ebp
push 0x65c3a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x4a]
mov eax, dword [ebp - 0x1c]
call fcn.00424524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c3cc
cmp byte [0x68b8dd], 0
je 0x65c3e8
cmp byte [ebp - 0x17], 0
je 0x65c3e8
mov edx, dword [ebp - 0x1c]
mov eax, 0x6601f0
call fcn.0064b908
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
cmp dword [ebp - 0x6c], 0x32
jge 0x65c401
push 0x64
call sub.kernel32.dll_Sleep_2
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65b7f4
xor eax, eax
push ebp
push 0x65c439
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b8a4]
call fcn.00623dc4
mov eax, dword [0x68b8a4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c443
push 0x660208
lea eax, [ebp - 0x130c]
push eax
mov ecx, 0x66023c
mov edx, 0x660250
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x130c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov edx, 0x66026c
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65c508
mov ecx, dword [ebp - 4]
mov edx, 0x66028c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c508
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1310]
push eax
lea edx, [ebp - 0x1314]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x1314]
mov edx, 0x6602ac
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1310]
mov eax, dword [ebp - 0x58]
call fcn.0064dbac
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65c4c6
cmp byte [0x68b8dd], 0
je 0x65c5a7
cmp byte [0x68b949], 0
jne 0x65c5a7
push dword [0x68b92c]
push 0x6602cc
push dword [0x68b920]
lea eax, [ebp - 0x1318]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1318]
mov eax, 0x6602dc
call fcn.0064b908
push dword [0x68b92c]
push 0x6602f4
movzx eax, byte [0x6602f8]
push eax
lea eax, [ebp - 0x1320]
push eax
mov ecx, 0x660308
mov edx, 0x660320
mov eax, dword [0x68b920]
call fcn.0042b81c
push dword [ebp - 0x1320]
lea eax, [ebp - 0x131c]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x131c]
mov eax, 0x660338
call fcn.0064b908
push 0
mov ecx, 0x660350
mov edx, 0x660368
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65cf4a
push 0
mov ecx, 0x660380
mov edx, 0x6603a4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jle 0x65c6dd
push 0x6603bc
lea eax, [ebp - 0x1324]
push eax
mov ecx, 0x6603f0
mov edx, 0x660404
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1324]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
cmp byte [0x68b8de], 0
je 0x65c634
mov word [ebp - 0x7a], 0
jmp 0x65c63a
mov word [ebp - 0x7a], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x660420
mov edx, 0x660450
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0xc], 0
jne 0x65c667
lea eax, [ebp - 0xc]
mov edx, 0x660468
call fcn.00409994
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x65c68a
mov eax, dword [ebp - 0x90]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jle 0x65c6dd
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x65c6dd
mov word [ebp - 0x7a], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x65c6c5
mov eax, dword [ebp - 0x94]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x94]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040a500
push 0
mov ecx, 0x6604a0
mov edx, 0x6604c4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
je 0x65c702
dec eax
je 0x65c80a
jmp 0x65c9c0
push 0
lea eax, [ebp - 0x132c]
push eax
mov ecx, 0x6604dc
mov edx, 0x660504
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x132c]
lea eax, [ebp - 0x1328]
mov edx, 0x66051c
call fcn.0040a390
mov eax, dword [ebp - 0x1328]
lea edx, [ebp - 8]
call fcn.00649348
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f0
test al, al
jne 0x65c75f
lea eax, [ebp - 8]
mov edx, dword [0x68b90c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f0
test al, al
je 0x65c7fe
lea edx, [ebp - 0x1330]
mov eax, 0x660544
call fcn.00649348
mov eax, dword [ebp - 0x1330]
mov dl, 1
call fcn.004241f0
test al, al
je 0x65c7fe
movzx eax, word [ebp - 0x7a]
push eax
push 1
push 0
push 0x660580
push dword [ebp - 8]
push 0x660594
push dword [ebp - 0xc]
lea eax, [ebp - 0x1338]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x1338]
lea edx, [ebp - 0x1334]
call fcn.00649348
mov eax, dword [ebp - 0x1334]
push eax
lea edx, [ebp - 0x133c]
mov eax, 0x6605a8
call fcn.00649348
mov eax, dword [ebp - 0x133c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaf4
pop edx
pop ecx
call fcn.00652e8c
jmp 0x65c9c0
mov byte [0x68b8e4], 1
jmp 0x65c9c0
push 0
lea eax, [ebp - 0x1340]
push eax
mov ecx, 0x6605e4
mov edx, 0x66060c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1340]
lea edx, [ebp - 8]
call fcn.00649348
cmp dword [ebp - 8], 0
je 0x65c9b9
lea edx, [ebp - 0x1344]
mov eax, dword [ebp - 8]
call fcn.006595d8
cmp dword [ebp - 0x1344], 0
je 0x65c9b9
lea edx, [ebp - 0x1348]
mov eax, 0x660624
call fcn.00649348
mov eax, dword [ebp - 0x1348]
mov dl, 1
call fcn.004241f0
test al, al
je 0x65c9b9
push 1
push 1
push 0
push 0x66066c
push dword [ebp - 8]
push 0x660684
lea edx, [ebp - 0x1354]
mov eax, dword [ebp - 8]
call fcn.006595d8
push dword [ebp - 0x1354]
push 0x6606bc
lea eax, [ebp - 0x1350]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0x1350]
lea edx, [ebp - 0x134c]
call fcn.00649348
mov eax, dword [ebp - 0x134c]
push eax
lea edx, [ebp - 0x1358]
mov eax, 0x6606cc
call fcn.00649348
mov eax, dword [ebp - 0x1358]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaf4
pop edx
pop ecx
call fcn.00652e8c
test al, al
je 0x65c9b0
mov eax, dword [0x68b908]
mov edx, 0x660714
call fcn.0040a4c8
je 0x65c9a7
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
movzx eax, word [ebp - 0x7a]
push eax
push 1
push 0
push 0x660724
lea edx, [ebp - 0x1364]
mov eax, dword [ebp - 8]
call fcn.006595d8
push dword [ebp - 0x1364]
push 0x660758
push dword [ebp - 0xc]
lea eax, [ebp - 0x1360]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x1360]
lea edx, [ebp - 0x135c]
call fcn.00649348
mov eax, dword [ebp - 0x135c]
push eax
lea edx, [ebp - 0x1368]
mov eax, 0x66076c
call fcn.00649348
mov eax, dword [ebp - 0x1368]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaf4
pop edx
pop ecx
call fcn.00652e8c
test al, al
jne 0x65c9c0
mov byte [0x68b8e4], 1
jmp 0x65c9c0
mov byte [0x68b8e4], 1
jmp 0x65c9c0
mov byte [0x68b8e4], 1
jmp 0x65c9c0
mov byte [0x68b8e4], 1
mov eax, dword [0x6857c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x65cab2
push 0x6607a8
lea eax, [ebp - 0x136c]
push eax
mov ecx, 0x6607e8
mov edx, 0x6607f8
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x136c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov ecx, dword [ebp - 4]
mov edx, 0x660814
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65ca96
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1370]
push eax
lea ecx, [ebp - 0x1374]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1374]
mov edx, 0x660838
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1370]
mov eax, dword [ebp - 0x58]
call fcn.00650da4
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65ca51
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov edx, 0x66085c
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65cb7c
push 0x66087c
lea eax, [ebp - 0x1378]
push eax
mov ecx, 0x6608c4
mov edx, 0x6608d4
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1378]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov ecx, dword [ebp - 4]
mov edx, 0x6608f0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65cb7c
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68b8e5], 0
jne 0x65cb7c
push 0
lea eax, [ebp - 0x137c]
push eax
lea edx, [ebp - 0x1380]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x1380]
mov edx, 0x660910
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x137c]
mov eax, dword [ebp - 0x58]
call fcn.0064f0ac
test al, al
je 0x65cb7c
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65cb2d
push 0x660930
lea eax, [ebp - 0x1384]
push eax
mov ecx, 0x660964
mov edx, 0x660978
mov eax, dword [0x68b8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1384]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.00541924
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov eax, 0x68b924
call fcn.0040956c
mov edx, 0x660994
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65cc4b
mov ecx, dword [ebp - 4]
mov edx, 0x6609a8
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65cc4b
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1388]
push eax
lea edx, [ebp - 0x138c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x138c]
mov edx, 0x6609bc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1388]
mov eax, dword [ebp - 0x58]
call fcn.00650570
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65cc09
push 0
mov ecx, 0x6609d0
mov edx, 0x6609fc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65cca9
push 0xffffffffffffffff
mov ecx, 0x660a14
mov edx, 0x660a40
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x65cca9
cmp byte [0x68b8e3], 0
je 0x65cc9c
mov edx, 0x660a58
mov eax, dword [ebp - 0x58]
call fcn.0064f0ac
jmp 0x65cca9
mov edx, 0x660b64
mov eax, dword [ebp - 0x58]
call fcn.0064f0ac
mov eax, dword [0x6857c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x65cd29
cmp byte [0x68b8e3], 0
je 0x65ccfb
push 0x660c70
push dword [0x68b904]
push 0x660d0c
lea eax, [ebp - 0x1390]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1390]
mov eax, dword [ebp - 0x58]
call fcn.0064f0ac
jmp 0x65cd29
push 0x660d40
push dword [0x68b904]
push 0x660ddc
lea eax, [ebp - 0x1394]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1394]
mov eax, dword [ebp - 0x58]
call fcn.0064f0ac
mov edx, 0x660e10
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65cdf2
mov ecx, dword [ebp - 4]
mov edx, 0x660e38
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65cdb2
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1398]
push eax
lea edx, [ebp - 0x139c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x139c]
mov edx, 0x660e60
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1398]
mov eax, dword [ebp - 0x58]
call fcn.00651a6c
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65cd70
xor eax, eax
push ebp
push 0x65cde8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x78]
push eax
push 0x1388
push 2
push 0x660e7c
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65cdf2
mov edx, 0x660ea0
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65ce77
mov ecx, dword [ebp - 4]
mov edx, 0x660ebc
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65ce77
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x13a0]
push eax
lea edx, [ebp - 0x13a4]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x13a4]
mov edx, 0x660ed8
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x13a0]
mov eax, dword [ebp - 0x58]
call fcn.0065446c
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65ce35
mov edx, 0x660ef4
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x65cf4a
mov ecx, dword [ebp - 4]
mov edx, 0x660f14
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65cf4a
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x13a8]
push eax
lea edx, [ebp - 0x13ac]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x13ac]
mov edx, 0x660f34
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x13a8]
mov dx, 4
mov eax, dword [ebp - 0x58]
call fcn.006562d4
push 0
lea eax, [ebp - 0x13b0]
push eax
lea edx, [ebp - 0x13b4]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x13b4]
mov edx, 0x660f54
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x13b0]
mov dx, 5
mov eax, dword [ebp - 0x58]
call fcn.006562d4
inc dword [ebp - 0x60]
dec dword [ebp - 0x80]
jne 0x65cec2
cmp byte [0x68b8dc], 0
je 0x65cf81
xor eax, eax
push ebp
push 0x65cf77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b978]
push eax
call dword [0x68b974]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65cf81
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
mov edx, 0x64
call fcn.0057651c
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
push 0x1f4
call sub.kernel32.dll_Sleep_2
cmp byte [0x68b8dd], 0
je 0x65cfd2
push 0
mov ecx, 0x660f74
mov edx, 0x660f9c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65cfd2
call fcn.00658488
push 0
mov ecx, 0x660fb4
mov edx, 0x660fe4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x65d00a
push 0
mov ecx, 0x660ffc
mov edx, 0x661030
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65d0b6
lea edx, [ebp - 0x13b8]
mov eax, 0x661048
call fcn.00649348
mov eax, dword [ebp - 0x13b8]
mov dl, 1
call fcn.004241f0
test al, al
je 0x65d0b6
xor eax, eax
push ebp
push 0x65d0ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x13bc]
mov eax, 0x661090
call fcn.00649348
mov eax, dword [ebp - 0x13bc]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13c0]
mov ecx, 0x6610d4
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x13c0]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x13c4]
mov eax, 0x661100
call fcn.00649348
mov edx, dword [ebp - 0x13c4]
mov eax, 0x661144
call fcn.0064b908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65d0b6
xor eax, eax
push ebp
push 0x65d0e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b954]
call fcn.004078f0
mov eax, dword [ebp - 4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65d0ea
cmp byte [0x68b94e], 0
je 0x65d117
mov eax, dword [0x68b92c]
call fcn.00659670
test al, al
jne 0x65d117
push 0
mov ecx, 0x66115c
mov edx, 0x661188
mov eax, dword [0x68b8d8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
xor eax, eax
push ebp
push 0x65d143
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b8d8]
mov edx, dword [eax]
call dword [edx + 0x60]
mov eax, dword [0x68b8d8]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65d14d
cmp byte [0x68b8dd], 0
je 0x65d2af
cmp byte [0x68b949], 0
jne 0x65d245
push 0
push dword [0x68b92c]
push 0x6611a4
push dword [0x68b920]
lea eax, [ebp - 0x13c8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x13c8]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13cc]
mov ecx, 0x6611b4
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x13cc]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x65d23e
push 0
push dword [0x68b92c]
push 0x6611e0
movzx eax, byte [0x6602f8]
push eax
lea eax, [ebp - 0x13d4]
push eax
mov ecx, 0x6611f0
mov edx, 0x661208
mov eax, dword [0x68b920]
call fcn.0042b81c
push dword [ebp - 0x13d4]
lea eax, [ebp - 0x13d0]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x13d0]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13d8]
mov ecx, 0x661220
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x13d8]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65d245
mov byte [0x68b8e4], 1
cmp byte [0x68b949], 0
je 0x65d2af
push 0
push dword [0x68b92c]
push 0x66124c
push dword [0x68b940]
lea eax, [ebp - 0x13dc]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x13dc]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13e0]
mov ecx, 0x66125c
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x13e0]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65d2af
mov byte [0x68b8e4], 1
cmp byte [0x68b8dd], 0
jne 0x65d32b
push 0
mov ecx, 0x661288
mov edx, 0x6612a4
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65d32b
mov eax, 0x6612bc
call fcn.00646680
test al, al
jne 0x65d32b
push 0
lea eax, [ebp - 0x13e4]
mov ecx, 0x6612ec
mov edx, dword [0x68b92c]
call fcn.0040a390
mov eax, dword [ebp - 0x13e4]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13e8]
mov ecx, 0x661314
mov edx, dword [0x68b900]
call fcn.0040a390
mov eax, dword [ebp - 0x13e8]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x661340
mov edx, 0x66136c
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65d3b9
push 0xffffffffffffffff
mov ecx, 0x661384
mov edx, 0x6613b0
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x65d3b9
push 5
push 0
push 1
lea edx, [ebp - 0x13f0]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x13f0]
lea eax, [ebp - 0x13ec]
mov edx, 0x6613c8
call fcn.0040a390
mov eax, dword [ebp - 0x13ec]
push eax
lea eax, [ebp - 0x13f4]
mov ecx, 0x6613f4
mov edx, dword [0x68b92c]
call fcn.0040a390
mov edx, dword [ebp - 0x13f4]
xor eax, eax
pop ecx
call fcn.00652e8c
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
mov byte [0x68b94b], 1
mov byte [0x68b8e6], 0
push 0x3e8
call sub.kernel32.dll_Sleep_2
push 0
mov ecx, 0x66141c
mov edx, 0x661434
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65d3fe
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d477
lea eax, [ebp - 0x13f4]
mov edx, 0x64
call fcn.004095cc
lea eax, [ebp - 0x1264]
call fcn.0040956c
lea eax, [ebp - 0x1258]
mov edx, 0x63
call fcn.004095cc
lea eax, [ebp - 0x10cc]
mov edx, 0xe
call fcn.004095cc
lea eax, [ebp - 0x52]
mov edx, dword [0x61d734]
call fcn.0040aa44
lea eax, [ebp - 0x1c]
mov edx, dword [0x659a1c]
call fcn.0040aa44
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004095cc
ret