Function at 0x64a5f8
Capabilities:
Copy file
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x277
push 0
push 0
dec ecx
jne 0x64a600
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x64a45c]
call fcn.0040c770
lea eax, [ebp - 0x52]
mov edx, dword [0x61e750]
call fcn.0040c770
xor eax, eax
push ebp
push 0x64dd4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x67ae21], 0
lea edx, [ebp - 0x10d4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.004273a0
mov eax, dword [ebp - 0x10d0]
lea edx, [ebp - 0x10cc]
call fcn.00431198
mov edx, dword [ebp - 0x10cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.0055144c
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x64dd6c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.0063acc0
mov edx, dword [ebp - 0x10d8]
mov eax, 0x67ae4c
call fcn.0040b850
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
xor edx, edx
call fcn.0058eecc
push 0x64dda0
lea eax, [ebp - 0x10e0]
push eax
mov ecx, 0x64ddc8
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
push 0
mov ecx, 0x64ddf8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov byte [0x67ae24], al
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
xor eax, eax
mov dword [0x67ae98], eax
xor eax, eax
mov dword [0x67ae9c], eax
xor eax, eax
mov dword [0x67aea0], eax
xor eax, eax
mov dword [0x67aea4], eax
mov dl, 1
mov eax, dword [0x487bf8]
call fcn.004b3db4
mov dword [0x67ae84], eax
cmp byte [0x67ae25], 0
je 0x64a927
lea edx, [ebp - 0x10e4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
push dword [ebp - 0x10e4]
push 0x64de20
lea ecx, [ebp - 0x10e8]
mov edx, 0x64de30
mov eax, dword [0x67ae74]
call fcn.00429060
push dword [ebp - 0x10e8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c2ac
lea edx, [ebp - 0x10ec]
mov eax, dword [ebp - 8]
call fcn.00637bb4
mov eax, dword [ebp - 0x10ec]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64a927
push 0
lea eax, [ebp - 0x10f0]
mov ecx, 0x64de48
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x10f0]
call fcn.0040bfd8
push eax
lea edx, [ebp - 0x10f4]
mov eax, dword [ebp - 8]
call fcn.00637bb4
mov eax, dword [ebp - 0x10f4]
call fcn.0040bfd8
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x64a927
lea eax, [ebp - 0x10f8]
mov ecx, 0x64de48
mov edx, dword [0x67ae44]
call fcn.0040c224
mov ecx, dword [ebp - 0x10f8]
mov dl, 1
mov eax, dword [0x50f088]
call fcn.00512b98
mov dword [0x67ae14], eax
mov ecx, dword [0x67ae84]
mov edx, 0x64de74
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64a8bd
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x10fc]
mov eax, dword [0x67ae84]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10fc]
push eax
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00427f4c
inc eax
mov dword [0x67aea0], eax
mov ecx, dword [0x67ae84]
mov edx, 0x64de8c
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64a91d
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1100]
mov eax, dword [0x67ae84]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1100]
push eax
mov eax, dword [0x67ae84]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00427f4c
inc eax
mov dword [0x67aea4], eax
mov eax, dword [0x67ae14]
call fcn.00409670
call fcn.004378a4
push eax
lea eax, [ebp - 0x1104]
mov ecx, 0x64de48
mov edx, dword [0x67ae44]
call fcn.0040c224
mov ecx, dword [ebp - 0x1104]
mov dl, 1
mov eax, dword [0x50f088]
call fcn.00512bdc
mov dword [0x67ae14], eax
cmp byte [0x67ae25], 0
je 0x64a9d7
mov eax, 0x64deb8
call fcn.00637aac
test al, al
jne 0x64a9d7
mov edx, 0x64dee8
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64a993
mov edx, 0x64dee8
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x64df20
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64a9b5
mov edx, 0x64df20
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x64df54
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64a9d7
mov edx, 0x64df54
mov eax, dword [0x67ae14]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x64df88
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64aa0f
push 0
mov ecx, 0x64dfac
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x64ac54
lea edx, [ebp - 0x1108]
mov al, 0x1c
call fcn.00638e84
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x64dfd4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x110c]
mov al, 0x1d
call fcn.00638e84
mov eax, dword [ebp - 0x110c]
push eax
mov ecx, 0x64e00c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x64e030
mov edx, 0x64e040
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.0063acc0
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x64e030
mov edx, 0x64e060
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b460
push 0
mov ecx, 0x64e080
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64aaf1
push 0
mov ecx, 0x64e09c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64aaf1
lea eax, [ebp - 8]
mov edx, 0x64e0b4
call fcn.0040b898
push 0
lea eax, [ebp - 0x1120]
push eax
mov ecx, 0x64e170
mov edx, 0x64e040
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1120]
lea edx, [ebp - 0x111c]
call fcn.0063acc0
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x1118]
mov edx, dword [ebp - 8]
call fcn.0040c224
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x64e170
mov edx, 0x64e060
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x1128]
push eax
lea edx, [ebp - 0x112c]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x112c]
mov edx, 0x64e040
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1128]
lea edx, [ebp - 0x1124]
call fcn.0063acc0
mov eax, dword [ebp - 0x1124]
push eax
lea edx, [ebp - 0x1130]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1130]
mov edx, 0x64e060
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x64ab55
push 0
mov ecx, 0x64e180
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64ac54
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x1138]
push eax
lea edx, [ebp - 0x113c]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x113c]
mov edx, 0x64e180
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1138]
lea edx, [ebp - 0x1134]
call fcn.0063acc0
mov eax, dword [ebp - 0x1134]
push eax
lea edx, [ebp - 0x1140]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1140]
mov edx, 0x64e180
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x1e
jne 0x64abe4
lea edx, [ebp - 0x1144]
mov al, 0x37
call fcn.00638e84
mov eax, dword [ebp - 0x1144]
push eax
mov ecx, 0x64e19c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x67ae1e]
xor al, 1
push eax
mov ecx, 0x64e1b4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x67ae1e]
push eax
mov ecx, 0x64e1d8
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x67ae1b]
push eax
mov ecx, 0x64e1f8
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x67ae18]
push eax
mov ecx, 0x64e210
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
lea edx, [ebp - 0x1148]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x64e224
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x64e248
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64ad49
mov ecx, 0x64e248
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x67ae4c], 0
je 0x64ad6c
mov eax, dword [0x67ae4c]
push eax
mov ecx, 0x64dd6c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [ebp - 0x75], 0
mov edx, 0x64e274
mov eax, dword [0x67ae0c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64ae4f
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x3e8]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x64e274
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x16c]
dec eax
test eax, eax
jl 0x64ae4f
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1150]
push eax
lea edx, [ebp - 0x1154]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1154]
mov edx, 0x64e274
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00426f98
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, 0x64e294
call fcn.0040c4f0
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x64ae44
mov byte [ebp - 0x75], 1
jmp 0x64ae4f
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64add1
cmp byte [ebp - 0x75], 0
je 0x64ae6f
mov eax, dword [0x67ae64]
push eax
mov ecx, 0x64e2bc
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x67ae19], 0
je 0x64b302
cmp byte [0x67ae1a], 0
je 0x64aeab
mov eax, 0x64e2e8
call fcn.00637aac
test al, al
je 0x64aeab
push 1
mov ecx, 0x64e310
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64aed6
push 0
mov ecx, 0x64e334
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e310
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e360
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e360
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e388
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e388
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e3b8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64af91
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x64e3e8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.0063acc0
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x64e3e8
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x64afa7
push 0
mov ecx, 0x64e3e8
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64e428
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b01d
push 0
lea eax, [ebp - 0x1168]
push eax
mov ecx, 0x64e45c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00638c78
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.0063acc0
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x64e45c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x64b033
push 0
mov ecx, 0x64e45c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64e484
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e484
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e4ac
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b13b
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x64e4dc
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.0063acc0
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x64e514
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x64e534
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.0063acc0
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x64e56c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64e594
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e5d0
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64b167
mov ecx, 0x64e514
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64b167
mov ecx, 0x64e514
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64e5f8
call fcn.00637aac
push eax
mov ecx, 0x64e624
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64e64c
call fcn.00637aac
push eax
mov ecx, 0x64e67c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64e6ac
call fcn.00637aac
push eax
mov ecx, 0x64e6e0
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64e710
call fcn.00637aac
test al, al
je 0x64b1ea
push 1
mov ecx, 0x64e740
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64b216
mov ecx, 0x64e740
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64b216
mov ecx, 0x64e740
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64e770
call fcn.00637aac
test al, al
je 0x64b23c
push 1
mov ecx, 0x64e7a4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64b268
mov ecx, 0x64e7a4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64b268
mov ecx, 0x64e7a4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64e7d8
call fcn.00637aac
test al, al
je 0x64b28e
push 1
mov ecx, 0x64e814
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64b2ba
mov ecx, 0x64e814
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x64b2ba
mov ecx, 0x64e814
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x64e84c
call fcn.00637aac
test al, al
je 0x64b2de
push 0
mov ecx, 0x64e87c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x64e8a4
call fcn.00637aac
test al, al
je 0x64b302
push 1
mov ecx, 0x64e8cc
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e180
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b62e
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x64e8ec
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.0063acc0
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x64e8ec
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x64e90c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b62e
push 1
mov ecx, 0x64e90c
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e934
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e934
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e964
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e964
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e998
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e998
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e9c8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64e9c8
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64e9c8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b4c0
push 0xffffffffffffffff
mov ecx, 0x64e9f4
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x64e9f4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x64ea20
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b4d6
push 1
mov ecx, 0x64ea20
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x64b4d6
push 0
mov ecx, 0x64e9f4
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x64ea50
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b506
push 1
mov ecx, 0x64ea50
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64ea84
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x64ea84
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x64ea84
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64b576
push 0
mov ecx, 0x64eac0
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x64eac0
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x64eaf0
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.0063acc0
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x64eaf0
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x64eb20
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x118c], 0
je 0x64b62e
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x64eb20
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.0063acc0
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x64eb20
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0x64eb50
lea eax, [ebp - 0x1198]
push eax
mov ecx, 0x64eb84
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1198]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x67ae18], 0
je 0x64b6e9
xor eax, eax
push ebp
push 0x64b6df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x67aeb4], eax
push 0x64eb8c
push 0x64ebcc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004171b0
mov dword [0x67aeac], eax
push 0x64ebe8
push 0x64ebcc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004171b0
mov dword [0x67aeb0], eax
push 0x67aeb4
call dword [0x67aeac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b6e9
xor eax, eax
push ebp
push 0x64b76c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x119c]
xor eax, eax
call fcn.0040741c
mov ecx, dword [ebp - 0x119c]
mov dl, 1
mov eax, dword [0x48aeb0]
call fcn.004b6088
mov dword [0x67add8], eax
mov eax, dword [0x67ae00]
xor edx, edx
push edx
push eax
mov eax, dword [0x67add8]
call fcn.004b3fe8
push 0xff00
lea eax, [ebp - 0x11a0]
mov ecx, 0x64ec30
mov edx, dword [0x67ae44]
call fcn.0040c224
mov ecx, dword [ebp - 0x11a0]
mov dl, 1
mov eax, dword [0x48aeb0]
call fcn.004b6088
mov dword [0x67addc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b7c1
xor esi, esi
mov eax, dword [0x67ae04]
sub eax, esi
cmp eax, 0x1000
jb 0x64b7ea
lea edx, [ebp - 0x10c8]
mov ecx, 0x1000
mov eax, dword [0x67add8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x64b804
mov ecx, dword [0x67ae04]
sub ecx, esi
lea edx, [ebp - 0x10c8]
mov eax, dword [0x67add8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10c8]
mov ecx, ebx
mov eax, dword [0x67addc]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x67ae04]
mov dword [ebp - 0x11a8], eax
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fdivr dword [0x64ec50]
mov dword [ebp - 0x11a8], esi
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fmulp st(1)
call fcn.00407aa0
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058eecc
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
cmp ebx, 0x1000
je 0x64b7c3
mov eax, dword [0x67addc]
call fcn.00409670
mov eax, dword [0x67add8]
call fcn.00409670
push 0x64ec60
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x64ec90
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
mov dl, 1
mov eax, dword [0x61eea4]
call fcn.00625da8
mov dword [0x67ade0], eax
xor eax, eax
push ebp
push 0x64b91f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11b0]
mov ecx, 0x64ec30
mov edx, dword [0x67ae44]
call fcn.0040c224
mov edx, dword [ebp - 0x11b0]
mov cl, 1
mov eax, dword [0x67ade0]
call fcn.00625e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64b974
mov dl, 1
mov eax, dword [0x487bf8]
call fcn.004b3db4
mov dword [ebp - 4], eax
mov byte [ebp - 0x7d], 0
push 0
mov ecx, 0x64eca0
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, 0x64ecc4
call fcn.00637aac
xor al, 1
mov byte [ebp - 0x79], al
mov eax, 0x64ecec
call fcn.00637aac
xor al, 1
mov byte [ebp - 0x7b], al
mov eax, 0x64ed14
call fcn.00637aac
mov byte [ebp - 0x7a], al
mov eax, 0x64ed40
call fcn.00637aac
mov byte [0x67ae1f], al
mov eax, 0x64ed68
call fcn.00637aac
xor al, 1
mov byte [0x67ae2b], al
mov eax, 0x64ed9c
call fcn.00637aac
xor al, 1
mov byte [0x67ae2c], al
mov eax, 0x64edc4
call fcn.00637aac
mov byte [0x67ae2d], al
mov eax, 0x64edf4
call fcn.00637aac
mov byte [ebp - 0x7c], al
mov byte [0x67ae28], 0
mov byte [0x67ae29], 0
lea eax, [ebp - 0x10]
call fcn.0040b460
push 0
mov ecx, 0x64ee2c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x67ae30], eax
push 0
mov ecx, 0x64ee50
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x67ae34], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f0]
cmp byte [eax + 0x69], 0
je 0x64bb86
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f4]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64bb86
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f4]
mov edx, dword [ebp - 0x60]
call fcn.00635a34
test al, al
jne 0x64bb77
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.0064a264
cmp dword [ebp - 8], 0
je 0x64bb77
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 8]
call fcn.00426f98
mov edx, dword [ebp - 0x11b4]
lea eax, [ebp - 8]
call fcn.0040b898
mov eax, dword [ebp - 8]
mov edx, 0x64ee74
call fcn.0040c35c
jne 0x64bb09
mov byte [0x67ae28], 1
jmp 0x64bb77
mov eax, dword [ebp - 8]
mov edx, 0x64ee98
call fcn.0040c35c
jne 0x64bb21
mov byte [0x67ae29], 1
jmp 0x64bb77
mov eax, dword [ebp - 8]
mov edx, 0x64eebc
call fcn.0040c35c
jne 0x64bb40
mov byte [0x67ae28], 1
mov byte [0x67ae29], 1
jmp 0x64bb77
mov eax, dword [ebp - 8]
mov edx, 0x64eedc
call fcn.0040c35c
jne 0x64bb5f
mov byte [0x67ae28], 1
mov byte [0x67ae29], 1
jmp 0x64bb77
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x64ef00
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c2ac
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64baa2
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x77]
push 0xffffffffffffffff
mov ecx, 0x64ef10
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x64cb31
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x67ae21], 0
je 0x64bc1f
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x11b8]
mov eax, dword [ebp - 0x74]
call fcn.00427cb8
mov eax, dword [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x11bc]
mov ecx, 0x64ef3c
mov edx, dword [0x67ae44]
call fcn.0040c224
mov ecx, dword [ebp - 0x11bc]
mov eax, dword [0x67ade0]
pop edx
call fcn.00626fa4
mov eax, dword [0x67ade0]
call fcn.00409670
push ebp
call fcn.0064a4bc
pop ecx
cmp byte [0x67ae28], 0
je 0x64bc37
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x67ae30]
jl 0x64cb22
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11c0]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x11c0]
mov edx, 0x64de74
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x64bc6a
mov al, 1
jmp 0x64bc8c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ef68
call fcn.0040c4f0
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
sete al
test al, al
jne 0x64cb22
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ef68
call fcn.0040c4f0
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xa0]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c394
cmp byte [0x67ae29], 0
je 0x64bceb
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x67ae30]
jl 0x64bceb
mov eax, dword [ebp - 0x1c]
mov edx, 0x64ef78
call fcn.0040c35c
jne 0x64cb22
cmp byte [ebp - 0x77], 0
je 0x64bdcc
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b898
jmp 0x64bda6
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64ef00
call fcn.0040c4f0
mov esi, eax
lea eax, [ebp - 0x11c4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c394
mov edi, dword [ebp - 0x11c4]
lea edx, [ebp - 0x11c8]
mov eax, dword [ebp - 0x1c]
call fcn.00426f98
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0xa4], eax
mov ecx, 1
mov edx, dword [ebp - 0xa4]
mov eax, edi
call fcn.0040c4f0
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jle 0x64bd7b
mov byte [ebp - 0x78], 1
jmp 0x64bdc2
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64ef00
call fcn.0040c4f0
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov edx, 1
call fcn.0040c3dc
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x64ef00
call fcn.0040c4f0
mov ebx, eax
test ebx, ebx
jg 0x64bd09
cmp byte [ebp - 0x78], 1
je 0x64cb22
lea edx, [ebp - 0x11cc]
mov eax, dword [ebp - 0x1c]
call fcn.0063acc0
mov edx, dword [ebp - 0x11cc]
lea eax, [ebp - 0x1c]
call fcn.0040b898
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64ef68
call fcn.0040c4f0
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xb0]
mov edx, 1
call fcn.0040c3dc
cmp dword [ebp - 0x1c], 0
jne 0x64be1d
mov al, 1
jmp 0x64be2f
mov eax, dword [ebp - 8]
test eax, eax
je 0x64be29
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x64cb22
lea eax, [ebp - 0x11d0]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040bff8
mov eax, dword [ebp - 0x11d0]
mov edx, 1
call fcn.00427f4c
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64be7a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x64c1b2
cmp byte [0x67ae24], 0
jne 0x64beb4
lea edx, [ebp - 0x11d4]
mov eax, dword [ebp - 0x1c]
call fcn.0063c618
mov edx, dword [ebp - 0x11d4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
call fcn.0055144c
fild dword [ebp - 0x6c]
fdivr dword [0x64efac]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407aa0
mov edx, eax
add edx, 0x1e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058eecc
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
lea edx, [ebp - 0x11d8]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x11d8]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64c1b2
movzx eax, byte [ebp - 0x17]
and al, byte [ebp - 0x7c]
je 0x64bf16
mov byte [ebp - 0x17], 0
cmp byte [ebp - 0x18], 0
jne case.0x64bf8f.0
cmp byte [0x67ae1a], 0
je 0x64bf32
mov byte [ebp - 0x18], 1
jmp case.0x64bf8f.0
cmp byte [ebp - 0x7d], 0
jne 0x64bfe3
push 0
push 0
lea eax, [ebp - 0x11e0]
push eax
mov ecx, 0x64ddc8
mov edx, 0x64e060
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11e0]
lea ecx, [ebp - 0x11dc]
mov edx, dword [ebp - 0x1c]
call fcn.0063b884
mov eax, dword [ebp - 0x11dc]
movzx ecx, word [0x64efb0]
xor edx, edx
call fcn.005a3034
cmp eax, 0xe
ja case.0x64bf8f.0
movzx eax, byte [eax + 0x64bf96]
jmp dword [eax*4 + 0x64bfa5]
mov byte [ebp - 0x18], 1
jmp case.0x64bf8f.0
mov byte [ebp - 0x18], 3
jmp case.0x64bf8f.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x7d], 1
jmp case.0x64bf8f.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x7d], 3
jmp case.0x64bf8f.0
mov byte [ebp - 0x18], 3
jmp case.0x64bf8f.0
movzx eax, byte [ebp - 0x7d]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 2
jne 0x64c0de
xor eax, eax
push ebp
push 0x64c0d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x52]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x67ade0]
call fcn.006247e8
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
push 0
lea edx, [ebp - 0x11e4]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov edx, dword [ebp - 0x11e4]
mov ecx, dword [0x67ae44]
mov eax, dword [0x67ade0]
call fcn.006265c4
push dword [0x67ae44]
push 0x64de20
lea edx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
push dword [ebp - 0x11ec]
lea eax, [ebp - 0x11e8]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x11e8]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00649b30
test al, al
je 0x64c088
mov byte [ebp - 0x18], 1
jmp 0x64c08c
mov byte [ebp - 0x18], 3
push dword [0x67ae44]
push 0x64de20
lea edx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
push dword [ebp - 0x11f4]
lea eax, [ebp - 0x11f0]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x11f0]
call fcn.00428f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c0de
cmp byte [ebp - 0x18], 1
jne 0x64c18d
xor eax, eax
push ebp
push 0x64c183
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x67ae1f], 0
je 0x64c160
push 0
push dword [0x67ae44]
push 0x64de20
lea edx, [ebp - 0x11fc]
mov eax, dword [ebp - 0x1c]
call fcn.004292a4
push dword [ebp - 0x11fc]
push 0x64efc0
lea eax, [ebp - 0x11f8]
mov edx, 4
call fcn.0040c2ac
mov eax, dword [ebp - 0x11f8]
call fcn.0040bfd8
push eax
lea edx, [ebp - 0x1200]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1200]
call fcn.0040bfd8
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1204]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1204]
call fcn.00428f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c18d
cmp byte [ebp - 0x18], 3
jne 0x64c1b2
mov eax, 0x64efe0
call fcn.00637aac
test al, al
jne 0x64cb22
mov eax, dword [ebp - 0x1c]
call fcn.00649d1c
jmp 0x64cb22
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x64c1be
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x64c1fd
lea edx, [ebp - 0x120c]
mov eax, dword [ebp - 0x1c]
call fcn.00429180
mov eax, dword [ebp - 0x120c]
lea edx, [ebp - 0x1208]
call fcn.00637bb4
mov eax, dword [ebp - 0x1208]
mov dl, 1
call fcn.004289f4
test al, al
jne 0x64c66f
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x1210]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c394
mov eax, dword [ebp - 0x1210]
mov edx, 0x64f010
call fcn.0040c35c
jne 0x64c290
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x64c252
mov eax, dword [ebp - 0xb4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xb4]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c394
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64de20
call fcn.0040c4f0
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x64c2c0
mov eax, dword [ebp - 0xc0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc0]
sub edx, eax
jl 0x64c665
inc edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x64c656
lea eax, [ebp - 0x1218]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c394
mov eax, dword [ebp - 0x1218]
lea edx, [ebp - 0x1214]
call fcn.00637bb4
mov eax, dword [ebp - 0x1214]
mov dl, 1
call fcn.004289f4
test al, al
jne 0x64c656
xor edx, edx
push ebp
push 0x64c3b9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1220]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c394
mov eax, dword [ebp - 0x1220]
lea edx, [ebp - 0x121c]
call fcn.00637bb4
mov eax, dword [ebp - 0x121c]
call fcn.004071cc
call fcn.00407170
cmp byte [0x67ae19], 0
je 0x64c3ac
cmp byte [ebp - 0x17], 0
je 0x64c3ac
lea eax, [ebp - 0x1224]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c394
mov edx, dword [ebp - 0x1224]
mov eax, 0x64f024
call fcn.0063cc5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c656
inc dword [ebp - 0x64]
dec dword [ebp - 0x90]
jne 0x64c2de
cmp byte [ebp - 0x75], 0
jne 0x64cb22
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64c67b
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x64cb22
lea edx, [ebp - 0x1264]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1264]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64c836
lea edx, [ebp - 0x126c]
mov eax, dword [ebp - 0x1c]
call fcn.00429300
mov eax, dword [ebp - 0x126c]
lea edx, [ebp - 0x1268]
call fcn.00426f98
mov eax, dword [ebp - 0x1268]
mov edx, 0x64f134
call fcn.0040c35c
jne 0x64c740
mov eax, dword [ebp - 0x1c]
call fcn.006379b0
test al, al
je 0x64c740
push 0
push 0
push 0x64f14c
lea edx, [ebp - 0x1274]
mov eax, dword [ebp - 0x1c]
call fcn.004292a4
push dword [ebp - 0x1274]
push 0x64f180
lea eax, [ebp - 0x1270]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x1270]
call fcn.0040bfd8
push eax
push 0x64f188
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x1278]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1278]
mov dl, 1
call fcn.00428c54
test eax, 1
jle 0x64c7a5
xor eax, eax
push ebp
push 0x64c79b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x127c]
mov cl, 1
mov edx, 0x80
call fcn.00428d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c7a5
lea edx, [ebp - 0x1284]
mov eax, dword [ebp - 0x1c]
call fcn.00429300
mov eax, dword [ebp - 0x1284]
lea edx, [ebp - 0x1280]
call fcn.00426f98
mov eax, dword [ebp - 0x1280]
mov edx, 0x64f1a4
call fcn.0040c35c
je 0x64c807
lea edx, [ebp - 0x128c]
mov eax, dword [ebp - 0x1c]
call fcn.00429300
mov eax, dword [ebp - 0x128c]
lea edx, [ebp - 0x1288]
call fcn.00426f98
mov eax, dword [ebp - 0x1288]
mov edx, 0x64f1bc
call fcn.0040c35c
jne 0x64c836
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1290]
call fcn.00649c1c
push 0x12c
call sub.kernel32.dll_Sleep
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
mov byte [ebp - 0x76], 0
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1294]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64c894
xor eax, eax
push ebp
push 0x64c88a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1298]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x1298]
call fcn.00428f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64c894
xor eax, eax
push ebp
push 0x64c8f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
movzx eax, byte [ebp - 0x7a]
push eax
movzx eax, byte [ebp - 0x79]
push eax
movzx eax, byte [ebp - 0x7b]
push eax
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x1c]
call fcn.00637bb4
mov eax, dword [ebp - 0x129c]
push eax
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov edx, dword [ebp - 0x12a0]
mov eax, dword [0x67ade0]
pop ecx
call fcn.00626fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64cad5
cmp byte [ebp - 0x76], 0
jne 0x64c836
cmp byte [ebp - 0x7a], 0
je 0x64caed
mov eax, dword [ebp - 0x1c]
call fcn.0064a37c
cmp byte [0x67ae19], 0
je 0x64cb09
cmp byte [ebp - 0x17], 0
je 0x64cb09
mov edx, dword [ebp - 0x1c]
mov eax, 0x64de74
call fcn.0063cc5c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
cmp dword [ebp - 0x6c], 0x32
jge 0x64cb22
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64bbc1
xor eax, eax
push ebp
push 0x64cb5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67ade0]
call fcn.00625fd0
mov eax, dword [0x67ade0]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64cb67
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x63
call fcn.0058eecc
push 0x64f34c
lea eax, [ebp - 0x12c4]
push eax
mov ecx, 0x64f380
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
mov ecx, dword [ebp - 4]
mov edx, 0x64e274
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64cc93
push 0x64f394
lea eax, [ebp - 0x12c8]
push eax
mov ecx, 0x64f3cc
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64cc83
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12cc]
push eax
lea ecx, [ebp - 0x12d0]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12d0]
mov edx, 0x64e274
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12cc]
mov eax, dword [ebp - 0x58]
call fcn.0063f1f4
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64cc3b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
cmp byte [0x67ae19], 0
je 0x64ccff
cmp byte [0x67ae25], 0
jne 0x64ccff
lea edx, [ebp - 0x12d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
push dword [ebp - 0x12d8]
push 0x64de20
lea ecx, [ebp - 0x12dc]
mov edx, 0x64de30
mov eax, dword [0x67ae74]
call fcn.00429060
push dword [ebp - 0x12dc]
lea eax, [ebp - 0x12d4]
mov edx, 3
call fcn.0040c2ac
mov edx, dword [ebp - 0x12d4]
mov eax, 0x64de74
call fcn.0063cc5c
push 0
mov ecx, 0x64e09c
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64d80b
push 0
mov ecx, 0x64f3dc
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x64ce4e
push 0x64eb50
lea eax, [ebp - 0x12e0]
push eax
mov ecx, 0x64eb84
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
cmp byte [0x67ae1a], 0
je 0x64cd9f
mov word [ebp - 0x86], 0
jmp 0x64cda8
mov word [ebp - 0x86], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x64f400
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x64cdd5
lea eax, [ebp - 0xc]
mov edx, 0x64f430
call fcn.0040b898
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x64cdf8
mov eax, dword [ebp - 0xc4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jle 0x64ce4e
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x64ce4e
mov word [ebp - 0x86], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x64ce36
mov eax, dword [ebp - 0xc8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc8]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c394
push 0
mov ecx, 0x64f3dc
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x64ce73
dec eax
je 0x64cf8f
jmp 0x64d148
push 0
lea eax, [ebp - 0x12e8]
push eax
mov ecx, 0x64f468
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x12e8]
lea eax, [ebp - 0x12e4]
mov edx, 0x64f490
call fcn.0040c224
mov eax, dword [ebp - 0x12e4]
lea edx, [ebp - 8]
call fcn.0063acc0
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0042895c
test al, al
jne 0x64ced0
lea eax, [ebp - 8]
mov edx, dword [0x67ae68]
call fcn.0040b898
lea edx, [ebp - 0x12ec]
mov eax, dword [ebp - 8]
call fcn.00637bb4
mov eax, dword [ebp - 0x12ec]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64cf83
lea edx, [ebp - 0x12f0]
mov eax, 0x64f4b8
call fcn.0063acc0
mov eax, dword [ebp - 0x12f0]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64cf83
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x64f4f4
push dword [ebp - 8]
push 0x64f508
push dword [ebp - 0xc]
lea eax, [ebp - 0x12f8]
mov edx, 4
call fcn.0040c2ac
mov eax, dword [ebp - 0x12f8]
lea edx, [ebp - 0x12f4]
call fcn.0063acc0
mov eax, dword [ebp - 0x12f4]
push eax
lea edx, [ebp - 0x12fc]
mov eax, 0x64f4b8
call fcn.0063acc0
mov eax, dword [ebp - 0x12fc]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b058
pop edx
pop ecx
call fcn.00643b34
jmp 0x64d148
mov byte [0x67ae20], 1
jmp 0x64d148
push 0
lea eax, [ebp - 0x1300]
push eax
mov ecx, 0x64f468
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1300]
lea edx, [ebp - 8]
call fcn.0063acc0
cmp dword [ebp - 8], 0
je 0x64d141
lea edx, [ebp - 0x1304]
mov eax, dword [ebp - 8]
call fcn.00649e80
cmp dword [ebp - 0x1304], 0
je 0x64d141
lea edx, [ebp - 0x1308]
mov eax, 0x64f51c
call fcn.0063acc0
mov eax, dword [ebp - 0x1308]
mov dl, 1
call fcn.0042895c
test al, al
je 0x64d141
push 1
push 1
push 0
push 0x64f564
push dword [ebp - 8]
push 0x64f57c
lea edx, [ebp - 0x1314]
mov eax, dword [ebp - 8]
call fcn.00649e80
push dword [ebp - 0x1314]
push 0x64f5b4
lea eax, [ebp - 0x1310]
mov edx, 5
call fcn.0040c2ac
mov eax, dword [ebp - 0x1310]
lea edx, [ebp - 0x130c]
call fcn.0063acc0
mov eax, dword [ebp - 0x130c]
push eax
lea edx, [ebp - 0x1318]
mov eax, 0x64f51c
call fcn.0063acc0
mov eax, dword [ebp - 0x1318]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b058
pop edx
pop ecx
call fcn.00643b34
test al, al
je 0x64d138
mov eax, dword [0x67ae50]
mov edx, 0x64ec90
call fcn.0040c35c
je 0x64d12f
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x64f5c4
lea edx, [ebp - 0x1324]
mov eax, dword [ebp - 8]
call fcn.00649e80
push dword [ebp - 0x1324]
push 0x64f508
push dword [ebp - 0xc]
lea eax, [ebp - 0x1320]
mov edx, 4
call fcn.0040c2ac
mov eax, dword [ebp - 0x1320]
lea edx, [ebp - 0x131c]
call fcn.0063acc0
mov eax, dword [ebp - 0x131c]
push eax
lea edx, [ebp - 0x1328]
mov eax, 0x64f4b8
call fcn.0063acc0
mov eax, dword [ebp - 0x1328]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b058
pop edx
pop ecx
call fcn.00643b34
test al, al
jne 0x64d148
mov byte [0x67ae20], 1
jmp 0x64d148
mov byte [0x67ae20], 1
jmp 0x64d148
mov byte [0x67ae20], 1
jmp 0x64d148
mov byte [0x67ae20], 1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c4]
cmp byte [eax + 0x69], 0
je 0x64d25f
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c4]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x64d25f
push 0x64f5f8
lea eax, [ebp - 0x132c]
push eax
mov ecx, 0x64f638
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x132c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x1f4
call sub.kernel32.dll_Sleep
mov ecx, dword [ebp - 4]
mov edx, 0x64f648
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64d233
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x1334]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1334]
mov edx, 0x64f648
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1330]
mov eax, dword [ebp - 0x58]
call fcn.00642030
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d1eb
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov ecx, dword [ebp - 4]
mov edx, 0x64f66c
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64d34b
push 0x64f68c
lea eax, [ebp - 0x1338]
push eax
mov ecx, 0x64f6d4
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1338]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64d33b
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x67ae21], 0
jne 0x64d33b
push 0
lea eax, [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x1340]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1340]
mov edx, 0x64f66c
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x133c]
mov eax, dword [ebp - 0x58]
call fcn.00640820
test al, al
je 0x64d33b
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d2e6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov eax, 0x67ae78
call fcn.0040b460
mov edx, 0x64f6e4
mov eax, dword [0x67ae0c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64d3e0
mov ecx, dword [ebp - 4]
mov edx, 0x64f6e4
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64d3e0
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1344]
push eax
lea edx, [ebp - 0x1348]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1348]
mov edx, 0x64f6e4
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1344]
mov eax, dword [ebp - 0x58]
call fcn.006418bc
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d39b
push 0
mov ecx, 0x64e9c8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64d45a
push 0xffffffffffffffff
mov ecx, 0x64e9f4
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jne 0x64d45a
cmp byte [0x67ae1e], 0
je 0x64d42c
lea eax, [ebp - 8]
mov edx, 0x64f6f8
call fcn.0040b898
jmp 0x64d439
lea eax, [ebp - 8]
mov edx, 0x64f724
call fcn.0040b898
lea eax, [ebp - 0x134c]
mov ecx, 0x64f750
mov edx, dword [ebp - 8]
call fcn.0040c224
mov edx, dword [ebp - 0x134c]
mov eax, dword [ebp - 0x58]
call fcn.00640820
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4e0]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x64d4c5
cmp byte [0x67ae1e], 0
je 0x64d487
lea eax, [ebp - 8]
mov edx, 0x64f6f8
call fcn.0040b898
jmp 0x64d494
lea eax, [ebp - 8]
mov edx, 0x64f724
call fcn.0040b898
push dword [ebp - 8]
push 0x64f840
push dword [0x67ae4c]
push 0x64f8c0
lea eax, [ebp - 0x1350]
mov edx, 4
call fcn.0040c2ac
mov edx, dword [ebp - 0x1350]
mov eax, dword [ebp - 0x58]
call fcn.00640820
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov ecx, dword [ebp - 4]
mov edx, 0x64f8f4
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64d5e1
push 0x64f68c
lea eax, [ebp - 0x1354]
push eax
mov ecx, 0x64f6d4
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64d58e
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1358]
push eax
lea ecx, [ebp - 0x135c]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x135c]
mov edx, 0x64f8f4
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x58]
call fcn.00642ac8
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d546
xor eax, eax
push ebp
push 0x64d5c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0x1388
push 2
push 0x64f910
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d5d1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
push 0x64f34c
lea eax, [ebp - 0x1360]
push eax
mov ecx, 0x64f380
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1360]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
mov edx, 0x64f934
mov eax, dword [0x67ae0c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64d6ac
mov ecx, dword [ebp - 4]
mov edx, 0x64f934
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64d6ac
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1364]
push eax
lea edx, [ebp - 0x1368]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1368]
mov edx, 0x64f934
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1364]
mov eax, dword [ebp - 0x58]
call fcn.00644e24
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d667
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov edx, 0x64f950
mov eax, dword [0x67ae0c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x64d80b
mov ecx, dword [ebp - 4]
mov edx, 0x64f950
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64d80b
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x136c]
push eax
lea edx, [ebp - 0x1370]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1370]
mov edx, 0x64f950
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x136c]
mov ax, 4
call fcn.00646cfc
cmp byte [0x67ae23], 0
je 0x64d771
mov byte [0x67ae20], 1
cmp byte [0x67ae18], 0
je 0x64d76a
mov eax, dword [0x67aeb4]
push eax
call dword [0x67aeb0]
push ebp
call fcn.0064a4bc
pop ecx
push 0
lea eax, [ebp - 0x1374]
push eax
lea edx, [ebp - 0x1378]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x1378]
mov edx, 0x64f950
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1374]
mov ax, 5
call fcn.00646cfc
push 0x64f34c
lea eax, [ebp - 0x137c]
push eax
mov ecx, 0x64f380
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x137c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055144c
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x64d70a
cmp byte [0x67ae18], 0
je 0x64d842
xor eax, eax
push ebp
push 0x64d838
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67aeb4]
push eax
call dword [0x67aeb0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d842
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x64
call fcn.0058eecc
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
push 0x1f4
call sub.kernel32.dll_Sleep
push 0x64f34c
lea eax, [ebp - 0x1380]
push eax
mov ecx, 0x64f380
mov edx, 0x64dddc
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1380]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055144c
cmp byte [0x67ae19], 0
je 0x64d8c7
push 0
mov ecx, 0x64f970
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64d8c7
call fcn.00648f34
xor eax, eax
push ebp
push 0x64d8f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67ae84]
call fcn.00409670
mov eax, dword [ebp - 4]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d8fb
cmp byte [0x67ae27], 0
je 0x64d93d
lea edx, [ebp - 0x1384]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
mov eax, dword [ebp - 0x1384]
call fcn.00649f18
test al, al
jne 0x64d93d
push 0
mov ecx, 0x64e360
mov edx, 0x64dff0
mov eax, dword [0x67ae14]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
push ebp
push 0x64d969
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67ae14]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x67ae14]
call fcn.00409670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d973
cmp byte [0x67ae19], 0
je 0x64da1b
push 0
lea edx, [ebp - 0x1390]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
push dword [ebp - 0x1390]
push 0x64de20
lea ecx, [ebp - 0x1394]
mov edx, 0x64de30
mov eax, dword [0x67ae74]
call fcn.00429060
push dword [ebp - 0x1394]
lea eax, [ebp - 0x138c]
mov edx, 3
call fcn.0040c2ac
mov eax, dword [ebp - 0x138c]
lea edx, [ebp - 0x1388]
call fcn.00637bb4
mov eax, dword [ebp - 0x1388]
call fcn.0040bfd8
push eax
lea eax, [ebp - 0x1398]
mov ecx, 0x64de48
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x1398]
call fcn.0040bfd8
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x64da1b
mov byte [0x67ae20], 1
cmp byte [0x67ae19], 0
jne 0x64daf6
push 0
mov ecx, 0x64e180
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64daf6
lea edx, [ebp - 0x13a0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
lea eax, [ebp - 0x13a0]
mov edx, 0x64f998
call fcn.0040c1cc
mov eax, dword [ebp - 0x13a0]
lea edx, [ebp - 0x139c]
call fcn.00637bb4
mov eax, dword [ebp - 0x139c]
mov dl, 1
call fcn.0042895c
test al, al
jne 0x64daf6
push 0
lea edx, [ebp - 0x13a8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
lea eax, [ebp - 0x13a8]
mov edx, 0x64f998
call fcn.0040c1cc
mov eax, dword [ebp - 0x13a8]
lea edx, [ebp - 0x13a4]
call fcn.00637bb4
mov eax, dword [ebp - 0x13a4]
call fcn.0040bfd8
push eax
lea eax, [ebp - 0x13ac]
mov ecx, 0x64de48
mov edx, dword [0x67ae44]
call fcn.0040c224
mov eax, dword [ebp - 0x13ac]
call fcn.0040bfd8
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x64e180
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64dbb4
push 0
mov ecx, 0x64e9c8
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64dbb4
push 0xffffffffffffffff
mov ecx, 0x64e9f4
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x64dbb4
push 5
push 0
push 1
lea edx, [ebp - 0x13b4]
mov eax, dword [ebp - 0x60]
call fcn.00427cb8
mov ecx, dword [ebp - 0x13b4]
lea eax, [ebp - 0x13b0]
mov edx, 0x64f9c0
call fcn.0040c224
mov eax, dword [ebp - 0x13b0]
push eax
lea edx, [ebp - 0x13b8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.005513f8
lea eax, [ebp - 0x13b8]
mov edx, 0x64f9ec
call fcn.0040c1cc
mov edx, dword [ebp - 0x13b8]
xor eax, eax
pop ecx
call fcn.00643b34
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610270
cmp byte [0x67ae1a], 0
jne 0x64dbea
push 0
mov ecx, 0x64fa14
mov edx, 0x64dd88
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x64dbea
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64dd56
lea eax, [ebp - 0x13b8]
call fcn.0040b460
lea eax, [ebp - 0x13b4]
mov edx, 3
call fcn.0040b4c0
lea eax, [ebp - 0x13a8]
call fcn.0040b460
lea eax, [ebp - 0x13a4]
call fcn.0040b460
lea eax, [ebp - 0x13a0]
call fcn.0040b460
lea eax, [ebp - 0x139c]
mov edx, 3
call fcn.0040b4c0
lea eax, [ebp - 0x1390]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 0x1388]
call fcn.0040b460
lea eax, [ebp - 0x1384]
call fcn.0040b460
lea eax, [ebp - 0x1380]
mov edx, 0x2a
call fcn.0040b4c0
lea eax, [ebp - 0x12d8]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 0x12d0]
mov edx, 0x29
call fcn.0040b4c0
lea eax, [ebp - 0x1228]
call fcn.0040b460
lea eax, [ebp - 0x122c]
call fcn.0040b460
lea eax, [ebp - 0x1224]
mov edx, 0x1f
call fcn.0040b4c0
lea eax, [ebp - 0x11a0]
mov edx, 0x16
call fcn.0040b4c0
lea eax, [ebp - 0x1148]
call fcn.0040b460
lea eax, [ebp - 0x1144]
mov edx, 0x18
call fcn.0040b4c0
lea eax, [ebp - 0x10e4]
call fcn.0040b460
lea eax, [ebp - 0x10e0]
mov edx, 3
call fcn.0040b4c0
lea eax, [ebp - 0x10d4]
call fcn.0040b460
lea eax, [ebp - 0x10d0]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 0x52]
mov edx, dword [0x61e750]
call fcn.0040cb3c
lea eax, [ebp - 0x1c]
mov edx, dword [0x64a45c]
call fcn.0040cb3c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b4c0
pop eax
jmp eax