Function at 0x658748
Capabilities:
Authenticate hmac
Copy file
Create process on windows
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x279
push 0
push 0
dec ecx
jne 0x658750
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x6585a4]
call fcn.0040c7ac
lea eax, [ebp - 0x52]
mov edx, dword [0x61a760]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x65be30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x65be4c
call fcn.00644e7c
mov byte [0x68a280], al
mov byte [0x68a20f], 1
mov byte [0x68a20e], 0
mov byte [0x68a20d], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x400]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f0]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f4]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x404]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x408]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x40c]
call fcn.00551994
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x410]
call fcn.00551994
push 0x65be6c
lea eax, [ebp - 0x10cc]
push eax
mov ecx, 0x65be94
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
push 0x65bec4
lea eax, [ebp - 0x10d4]
push eax
mov ecx, 0x65bef0
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00648370
mov edx, dword [ebp - 0x10d0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f8]
call fcn.005513e8
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
xor edx, edx
call fcn.0058e0a0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0055199c
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
lea edx, [ebp - 0x10dc]
mov eax, dword [0x68a25c]
call fcn.00427468
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.00431278
mov edx, dword [ebp - 0x10d8]
mov eax, 0x68a25c
call fcn.0040b854
push 0
lea eax, [ebp - 0x10e8]
push eax
mov ecx, 0x65bf00
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10e8]
lea edx, [ebp - 0x10e4]
call fcn.00646418
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x10e0]
call fcn.00648370
mov edx, dword [ebp - 0x10e0]
mov eax, 0x68a22c
call fcn.0040b854
mov dl, 1
mov eax, dword [0x487c78]
call fcn.004b3e5c
mov dword [0x68a288], eax
xor eax, eax
mov dword [0x68a290], eax
xor eax, eax
mov dword [0x68a294], eax
xor eax, eax
mov dword [0x68a298], eax
xor eax, eax
mov dword [0x68a29c], eax
cmp byte [0x68a275], 0
je 0x658b02
push dword [0x68a25c]
push 0x65bf34
lea ecx, [ebp - 0x10ec]
mov edx, 0x65bf44
mov eax, dword [0x68a24c]
call fcn.00429128
push dword [ebp - 0x10ec]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c2e8
lea edx, [ebp - 0x10f0]
mov eax, dword [ebp - 8]
call fcn.00644f84
mov eax, dword [ebp - 0x10f0]
mov dl, 1
call fcn.00428a24
test al, al
je 0x658b02
push 0
lea eax, [ebp - 0x10f4]
mov ecx, 0x65bf5c
mov edx, dword [0x68a228]
call fcn.0040c260
mov eax, dword [ebp - 0x10f4]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x10f8]
mov eax, dword [ebp - 8]
call fcn.00644f84
mov eax, dword [ebp - 0x10f8]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x658b02
lea eax, [ebp - 0x10fc]
mov ecx, 0x65bf5c
mov edx, dword [0x68a228]
call fcn.0040c260
mov ecx, dword [ebp - 0x10fc]
mov dl, 1
mov eax, dword [0x50f024]
call fcn.00512b34
mov dword [0x68a200], eax
mov ecx, dword [0x68a288]
mov edx, 0x65bf88
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x658a98
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1100]
mov eax, dword [0x68a288]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1100]
push eax
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00428014
inc eax
mov dword [0x68a298], eax
mov ecx, dword [0x68a288]
mov edx, 0x65bfa0
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x658af8
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1104]
mov eax, dword [0x68a288]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1104]
push eax
mov eax, dword [0x68a288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00428014
inc eax
mov dword [0x68a29c], eax
mov eax, dword [0x68a200]
call fcn.00409674
call fcn.00437984
push eax
lea eax, [ebp - 0x1108]
mov ecx, 0x65bf5c
mov edx, dword [0x68a228]
call fcn.0040c260
mov ecx, dword [ebp - 0x1108]
mov dl, 1
mov eax, dword [0x50f024]
call fcn.00512b78
mov dword [0x68a200], eax
cmp byte [0x68a275], 0
je 0x658bb2
mov eax, 0x65bfcc
call fcn.00644e7c
test al, al
jne 0x658bb2
mov edx, 0x65bffc
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x658b6e
mov edx, 0x65bffc
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65c034
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x658b90
mov edx, 0x65c034
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65c068
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x658bb2
mov edx, 0x65c068
mov eax, dword [0x68a200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x65c09c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658bea
push 0
mov ecx, 0x65c0c0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x658e2f
lea edx, [ebp - 0x110c]
mov al, 0x1c
call fcn.006465ec
mov eax, dword [ebp - 0x110c]
push eax
mov ecx, 0x65c0e8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1110]
mov al, 0x1d
call fcn.006465ec
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x65c120
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1118]
push eax
mov ecx, 0x65c144
mov edx, 0x65c154
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1118]
lea edx, [ebp - 0x1114]
call fcn.00648370
mov eax, dword [ebp - 0x1114]
push eax
mov ecx, 0x65c144
mov edx, 0x65c174
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b464
push 0
mov ecx, 0x65c194
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658ccc
push 0
mov ecx, 0x65c1b0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658ccc
lea eax, [ebp - 8]
mov edx, 0x65c1c8
call fcn.0040b89c
push 0
lea eax, [ebp - 0x1124]
push eax
mov ecx, 0x65bef0
mov edx, 0x65c154
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00648370
mov ecx, dword [ebp - 0x1120]
lea eax, [ebp - 0x111c]
mov edx, dword [ebp - 8]
call fcn.0040c260
mov eax, dword [ebp - 0x111c]
push eax
mov ecx, 0x65bef0
mov edx, 0x65c174
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x112c]
push eax
lea edx, [ebp - 0x1130]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1130]
mov edx, 0x65c154
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.00648370
mov eax, dword [ebp - 0x1128]
push eax
lea edx, [ebp - 0x1134]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1134]
mov edx, 0x65c174
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x658d30
push 0
mov ecx, 0x65c284
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658e2f
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x113c]
push eax
lea edx, [ebp - 0x1140]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1140]
mov edx, 0x65c284
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x113c]
lea edx, [ebp - 0x1138]
call fcn.00648370
mov eax, dword [ebp - 0x1138]
push eax
lea edx, [ebp - 0x1144]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1144]
mov edx, 0x65c284
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x21
jne 0x658dbf
lea edx, [ebp - 0x1148]
mov al, 0x37
call fcn.006465ec
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65c2a0
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x68a20b]
xor al, 1
push eax
mov ecx, 0x65c2b8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a20b]
push eax
mov ecx, 0x65c2dc
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a208]
push eax
mov ecx, 0x65c2fc
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a204]
push eax
mov ecx, 0x65c314
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [0x68a25c]
push eax
mov ecx, 0x65c328
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x65c34c
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x658f0f
mov ecx, 0x65c34c
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x68a22c], 0
je 0x658f32
mov eax, dword [0x68a22c]
push eax
mov ecx, 0x65bf00
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [ebp - 0x75], 0
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x659015
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x418]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0x16c]
dec eax
test eax, eax
jl 0x659015
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1150]
push eax
lea edx, [ebp - 0x1154]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1154]
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00427060
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, 0x65c398
call fcn.0040c52c
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x65900a
mov byte [ebp - 0x75], 1
jmp 0x659015
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x658f97
cmp byte [ebp - 0x75], 0
je 0x659035
mov eax, dword [0x68a260]
push eax
mov ecx, 0x65c3c0
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x68a205], 0
je 0x6594c8
cmp byte [0x68a206], 0
je 0x659071
mov eax, 0x65c3ec
call fcn.00644e7c
test al, al
je 0x659071
push 1
mov ecx, 0x65c414
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65909c
push 0
mov ecx, 0x65c438
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65c414
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65c464
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65c464
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65c48c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65c48c
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65c4bc
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659157
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x65c4ec
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00648370
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65c4ec
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x65916d
push 0
mov ecx, 0x65c4ec
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65c52c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6591e3
push 0
lea eax, [ebp - 0x1168]
push eax
mov ecx, 0x65c560
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00646418
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00648370
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x65c560
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x6591f9
push 0
mov ecx, 0x65c560
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65c588
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65c588
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65c5b0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659301
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x65c5e0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.00648370
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x65c618
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x65c638
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.00648370
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x65c670
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65c698
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65c6d4
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65932d
mov ecx, 0x65c618
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65932d
mov ecx, 0x65c618
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65c6fc
call fcn.00644e7c
push eax
mov ecx, 0x65c728
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65c750
call fcn.00644e7c
push eax
mov ecx, 0x65c780
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65c7b0
call fcn.00644e7c
push eax
mov ecx, 0x65c7e4
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65c814
call fcn.00644e7c
test al, al
je 0x6593b0
push 1
mov ecx, 0x65c844
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x6593dc
mov ecx, 0x65c844
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x6593dc
mov ecx, 0x65c844
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65c874
call fcn.00644e7c
test al, al
je 0x659402
push 1
mov ecx, 0x65c8a8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65942e
mov ecx, 0x65c8a8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65942e
mov ecx, 0x65c8a8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65c8dc
call fcn.00644e7c
test al, al
je 0x659454
push 1
mov ecx, 0x65c918
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x659480
mov ecx, 0x65c918
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x659480
mov ecx, 0x65c918
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65c950
call fcn.00644e7c
test al, al
je 0x6594a4
push 0
mov ecx, 0x65c980
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65c9a8
call fcn.00644e7c
test al, al
je 0x6594c8
push 1
mov ecx, 0x65c9d0
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65c284
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6597f4
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x65c9f0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.00648370
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x65c9f0
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65ca10
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6597f4
push 1
mov ecx, 0x65ca10
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ca38
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ca38
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ca68
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ca68
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ca9c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ca9c
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65cacc
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65cacc
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65cacc
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659686
push 0xffffffffffffffff
mov ecx, 0x65caf8
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65caf8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65cb24
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65969c
push 1
mov ecx, 0x65cb24
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65969c
push 0
mov ecx, 0x65caf8
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65cb54
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6596cc
push 1
mov ecx, 0x65cb54
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65cb88
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65cb88
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65cb88
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65973c
push 0
mov ecx, 0x65cbc4
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65cbc4
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x65cbf4
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.00648370
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x65cbf4
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x65cc24
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x118c], 0
je 0x6597f4
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65cc24
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00648370
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x65cc24
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0x65cc54
lea eax, [ebp - 0x1198]
push eax
mov ecx, 0x65cc88
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1198]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x68a204], 0
je 0x6598af
xor eax, eax
push ebp
push 0x6598a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x68a2ac], eax
push 0x65cc90
push 0x65ccd0
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2a4], eax
push 0x65ccec
push 0x65ccd0
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2a8], eax
push 0x68a2ac
call dword [0x68a2a4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6598af
xor eax, eax
push ebp
push 0x659932
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x119c]
xor eax, eax
call fcn.00407414
mov ecx, dword [ebp - 0x119c]
mov dl, 1
mov eax, dword [0x48af30]
call fcn.004b6130
mov dword [0x68a1c8], eax
mov eax, dword [0x68a1f0]
xor edx, edx
push edx
push eax
mov eax, dword [0x68a1c8]
call fcn.004b4090
push 0xff00
lea eax, [ebp - 0x11a0]
mov ecx, 0x65cd34
mov edx, dword [0x68a228]
call fcn.0040c260
mov ecx, dword [ebp - 0x11a0]
mov dl, 1
mov eax, dword [0x48af30]
call fcn.004b6130
mov dword [0x68a1cc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659990
xor esi, esi
mov eax, dword [0x68a1f4]
sub eax, esi
cmp eax, 0x1000
jb 0x6599b9
lea edx, [ebp - 0x10c8]
mov ecx, 0x1000
mov eax, dword [0x68a1c8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x6599d3
mov ecx, dword [0x68a1f4]
sub ecx, esi
lea edx, [ebp - 0x10c8]
mov eax, dword [0x68a1c8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10c8]
mov ecx, ebx
mov eax, dword [0x68a1cc]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x68a1f4]
mov dword [ebp - 0x11a8], eax
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fdivr dword [0x65cd54]
mov dword [ebp - 0x11a8], esi
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058e0a0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.005519dc
cmp ebx, 0x1000
je 0x659992
mov eax, dword [0x68a1cc]
call fcn.00409674
mov eax, dword [0x68a1c8]
call fcn.00409674
push 0x65cd64
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65cd94
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov dl, 1
mov eax, dword [0x61aeb4]
call fcn.00621db8
mov dword [0x68a1d0], eax
xor eax, eax
push ebp
push 0x659af0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11b0]
mov ecx, 0x65cd34
mov edx, dword [0x68a228]
call fcn.0040c260
mov edx, dword [ebp - 0x11b0]
mov cl, 1
mov eax, dword [0x68a1d0]
call fcn.00621e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659b4e
mov dl, 1
mov eax, dword [0x487c78]
call fcn.004b3e5c
mov dword [ebp - 4], eax
mov byte [ebp - 0x7d], 0
push 0
mov ecx, 0x65cda4
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, 0x65cdc8
call fcn.00644e7c
xor al, 1
mov byte [ebp - 0x79], al
mov eax, 0x65cdf0
call fcn.00644e7c
xor al, 1
mov byte [ebp - 0x7b], al
mov eax, 0x65ce18
call fcn.00644e7c
mov byte [ebp - 0x7a], al
mov eax, 0x65ce44
call fcn.00644e7c
mov byte [0x68a20c], al
mov eax, 0x65ce6c
call fcn.00644e7c
xor al, 1
mov byte [0x68a27c], al
mov eax, 0x65cea0
call fcn.00644e7c
xor al, 1
mov byte [0x68a27d], al
mov eax, 0x65cec8
call fcn.00644e7c
mov byte [0x68a27e], al
mov eax, 0x65cef8
call fcn.00644e7c
mov byte [ebp - 0x7c], al
mov byte [0x68a211], 0
mov byte [0x68a212], 0
lea eax, [ebp - 0x10]
call fcn.0040b464
push 0
mov ecx, 0x65cf30
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68a214], eax
push 0
mov ecx, 0x65cf54
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68a218], eax
mov eax, dword [0x682650]
mov eax, dword [eax]
mov eax, dword [eax + 0x424]
cmp byte [eax + 0x69], 0
je 0x659d6c
mov eax, dword [0x682650]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659d6c
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [0x682650]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov edx, dword [ebp - 0x60]
call fcn.006400f0
test al, al
jne 0x659d5d
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.00658310
cmp dword [ebp - 8], 0
je 0x659d5d
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 8]
call fcn.00427060
mov edx, dword [ebp - 0x11b4]
lea eax, [ebp - 8]
call fcn.0040b89c
mov eax, dword [ebp - 8]
mov edx, 0x65cf78
call fcn.0040c398
jne 0x659cef
mov byte [0x68a211], 1
jmp 0x659d5d
mov eax, dword [ebp - 8]
mov edx, 0x65cf9c
call fcn.0040c398
jne 0x659d07
mov byte [0x68a212], 1
jmp 0x659d5d
mov eax, dword [ebp - 8]
mov edx, 0x65cfc0
call fcn.0040c398
jne 0x659d26
mov byte [0x68a211], 1
mov byte [0x68a212], 1
jmp 0x659d5d
mov eax, dword [ebp - 8]
mov edx, 0x65cfe0
call fcn.0040c398
jne 0x659d45
mov byte [0x68a211], 1
mov byte [0x68a212], 1
jmp 0x659d5d
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65d004
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c2e8
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659c84
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x77]
push 0xffffffffffffffff
mov ecx, 0x65d014
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x65ad21
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68a20e], 0
je 0x659e05
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x11b8]
mov eax, dword [ebp - 0x74]
call fcn.00427d80
mov eax, dword [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x11bc]
mov ecx, 0x65d040
mov edx, dword [0x68a228]
call fcn.0040c260
mov ecx, dword [ebp - 0x11bc]
mov eax, dword [0x68a1d0]
pop edx
call fcn.00622ff4
mov eax, dword [0x68a1d0]
call fcn.00409674
push ebp
call fcn.00658604
pop ecx
cmp byte [0x68a211], 0
je 0x659e1d
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68a214]
jl 0x65ad12
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11c0]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x11c0]
mov edx, 0x65bf88
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x659e50
mov al, 1
jmp 0x659e72
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65d06c
call fcn.0040c52c
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
sete al
test al, al
jne 0x65ad12
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65d06c
call fcn.0040c52c
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xa0]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
cmp byte [0x68a212], 0
je 0x659f06
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68a214]
jl 0x659f06
mov eax, dword [ebp - 0x1c]
mov edx, 0x65d07c
call fcn.0040c398
je 0x659f06
mov eax, dword [ebp - 0x1c]
mov edx, 0x65d0bc
call fcn.0040c398
je 0x659f06
lea eax, [ebp - 0x11c4]
mov ecx, dword [0x68a24c]
mov edx, 0x65d100
call fcn.0040c260
mov edx, dword [ebp - 0x11c4]
mov eax, dword [ebp - 0x1c]
call fcn.0040c398
jne 0x65ad12
cmp byte [ebp - 0x77], 0
je 0x659fe7
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b89c
jmp 0x659fc1
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65d004
call fcn.0040c52c
mov esi, eax
lea eax, [ebp - 0x11c8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c3d0
mov edi, dword [ebp - 0x11c8]
lea edx, [ebp - 0x11cc]
mov eax, dword [ebp - 0x1c]
call fcn.00427060
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0xa4], eax
mov ecx, 1
mov edx, dword [ebp - 0xa4]
mov eax, edi
call fcn.0040c52c
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jle 0x659f96
mov byte [ebp - 0x78], 1
jmp 0x659fdd
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65d004
call fcn.0040c52c
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov edx, 1
call fcn.0040c418
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65d004
call fcn.0040c52c
mov ebx, eax
test ebx, ebx
jg 0x659f24
cmp byte [ebp - 0x78], 0
jne 0x65ad12
lea edx, [ebp - 0x11d0]
mov eax, dword [ebp - 0x1c]
call fcn.00648370
mov edx, dword [ebp - 0x11d0]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65d06c
call fcn.0040c52c
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xb0]
mov edx, 1
call fcn.0040c418
cmp dword [ebp - 0x1c], 0
jne 0x65a038
mov al, 1
jmp 0x65a04a
mov eax, dword [ebp - 8]
test eax, eax
je 0x65a044
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x65ad12
lea eax, [ebp - 0x11d4]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x11d4]
mov edx, 1
call fcn.00428014
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65a095
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65a3a2
fild dword [ebp - 0x6c]
fdivr dword [0x65d11c]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
add edx, 0x1e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058e0a0
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
lea edx, [ebp - 0x11d8]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x11d8]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65a3a2
movzx eax, byte [ebp - 0x17]
and al, byte [ebp - 0x7c]
je 0x65a106
mov byte [ebp - 0x17], 0
cmp byte [ebp - 0x18], 0
jne case.0x65a17f.0
cmp byte [0x68a206], 0
je 0x65a122
mov byte [ebp - 0x18], 1
jmp case.0x65a17f.0
cmp byte [ebp - 0x7d], 0
jne 0x65a1d3
push 0
push 0
lea eax, [ebp - 0x11e0]
push eax
mov ecx, 0x65be94
mov edx, 0x65c174
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11e0]
lea ecx, [ebp - 0x11dc]
mov edx, dword [ebp - 0x1c]
call fcn.00648f38
mov eax, dword [ebp - 0x11dc]
movzx ecx, word [0x65d120]
xor edx, edx
call fcn.005a2208
cmp eax, 0xe
ja case.0x65a17f.0
movzx eax, byte [eax + 0x65a186]
jmp dword [eax*4 + 0x65a195]
mov byte [ebp - 0x18], 1
jmp case.0x65a17f.0
mov byte [ebp - 0x18], 3
jmp case.0x65a17f.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x7d], 1
jmp case.0x65a17f.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x7d], 3
jmp case.0x65a17f.0
mov byte [ebp - 0x18], 3
jmp case.0x65a17f.0
movzx eax, byte [ebp - 0x7d]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 2
jne 0x65a2ce
xor eax, eax
push ebp
push 0x65a2c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x52]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x68a1d0]
call fcn.006207f8
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
push 0
lea edx, [ebp - 0x11e4]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov edx, dword [ebp - 0x11e4]
mov ecx, dword [0x68a228]
mov eax, dword [0x68a1d0]
call fcn.006225d4
push dword [0x68a228]
push 0x65bf34
lea edx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
push dword [ebp - 0x11ec]
lea eax, [ebp - 0x11e8]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11e8]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00657d9c
test al, al
je 0x65a278
mov byte [ebp - 0x18], 1
jmp 0x65a27c
mov byte [ebp - 0x18], 3
push dword [0x68a228]
push 0x65bf34
lea edx, [ebp - 0x11f4]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
push dword [ebp - 0x11f4]
lea eax, [ebp - 0x11f0]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11f0]
call fcn.00428fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a2ce
cmp byte [ebp - 0x18], 1
jne 0x65a37d
xor eax, eax
push ebp
push 0x65a373
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x68a20c], 0
je 0x65a350
push 0
push dword [0x68a228]
push 0x65bf34
lea edx, [ebp - 0x11fc]
mov eax, dword [ebp - 0x1c]
call fcn.0042936c
push dword [ebp - 0x11fc]
push 0x65d130
lea eax, [ebp - 0x11f8]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x11f8]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x1200]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1200]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1204]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1204]
call fcn.00428fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a37d
cmp byte [ebp - 0x18], 3
jne 0x65a3a2
mov eax, 0x65d150
call fcn.00644e7c
test al, al
jne 0x65ad12
mov eax, dword [ebp - 0x1c]
call fcn.00657f88
jmp 0x65ad12
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x65a3ae
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x65a3ed
lea edx, [ebp - 0x120c]
mov eax, dword [ebp - 0x1c]
call fcn.00429248
mov eax, dword [ebp - 0x120c]
lea edx, [ebp - 0x1208]
call fcn.00644f84
mov eax, dword [ebp - 0x1208]
mov dl, 1
call fcn.00428abc
test al, al
jne 0x65a85f
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x1210]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1210]
mov edx, 0x65d180
call fcn.0040c398
jne 0x65a480
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x65a442
mov eax, dword [ebp - 0xb4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xb4]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65bf34
call fcn.0040c52c
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x65a4b0
mov eax, dword [ebp - 0xc0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc0]
sub edx, eax
jl 0x65a855
inc edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x65a846
lea eax, [ebp - 0x1218]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1218]
lea edx, [ebp - 0x1214]
call fcn.00644f84
mov eax, dword [ebp - 0x1214]
mov dl, 1
call fcn.00428abc
test al, al
jne 0x65a846
xor edx, edx
push ebp
push 0x65a5a9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1220]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1220]
lea edx, [ebp - 0x121c]
call fcn.00644f84
mov eax, dword [ebp - 0x121c]
call fcn.004071c4
call fcn.00407168
cmp byte [0x68a205], 0
je 0x65a59c
cmp byte [ebp - 0x17], 0
je 0x65a59c
lea eax, [ebp - 0x1224]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov edx, dword [ebp - 0x1224]
mov eax, 0x65d194
call fcn.0064ab38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a846
inc dword [ebp - 0x64]
dec dword [ebp - 0x90]
jne 0x65a4ce
cmp byte [ebp - 0x75], 0
jne 0x65ad12
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65a86b
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65ad12
lea edx, [ebp - 0x1264]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1264]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65aa26
lea edx, [ebp - 0x126c]
mov eax, dword [ebp - 0x1c]
call fcn.004293c8
mov eax, dword [ebp - 0x126c]
lea edx, [ebp - 0x1268]
call fcn.00427060
mov eax, dword [ebp - 0x1268]
mov edx, 0x65d2b0
call fcn.0040c398
jne 0x65a930
mov eax, dword [ebp - 0x1c]
call fcn.00644d80
test al, al
je 0x65a930
push 0
push 0
push 0x65d2c8
lea edx, [ebp - 0x1274]
mov eax, dword [ebp - 0x1c]
call fcn.0042936c
push dword [ebp - 0x1274]
push 0x65d2fc
lea eax, [ebp - 0x1270]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x1270]
call fcn.0040bffc
push eax
push 0x65d304
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x1278]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1278]
mov dl, 1
call fcn.00428d1c
test eax, 1
jle 0x65a995
xor eax, eax
push ebp
push 0x65a98b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x127c]
mov cl, 1
mov edx, 0x80
call fcn.00428dd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a995
lea edx, [ebp - 0x1284]
mov eax, dword [ebp - 0x1c]
call fcn.004293c8
mov eax, dword [ebp - 0x1284]
lea edx, [ebp - 0x1280]
call fcn.00427060
mov eax, dword [ebp - 0x1280]
mov edx, 0x65d320
call fcn.0040c398
je 0x65a9f7
lea edx, [ebp - 0x128c]
mov eax, dword [ebp - 0x1c]
call fcn.004293c8
mov eax, dword [ebp - 0x128c]
lea edx, [ebp - 0x1288]
call fcn.00427060
mov eax, dword [ebp - 0x1288]
mov edx, 0x65d338
call fcn.0040c398
jne 0x65aa26
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1290]
call fcn.00657e88
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov byte [ebp - 0x76], 0
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1294]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65aa84
xor eax, eax
push ebp
push 0x65aa7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1298]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x1298]
call fcn.00428fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65aa84
xor eax, eax
push ebp
push 0x65aae4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
movzx eax, byte [ebp - 0x7a]
push eax
movzx eax, byte [ebp - 0x79]
push eax
movzx eax, byte [ebp - 0x7b]
push eax
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x129c]
push eax
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov edx, dword [ebp - 0x12a0]
mov eax, dword [0x68a1d0]
pop ecx
call fcn.00622ff4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65acc5
cmp byte [ebp - 0x76], 0
jne 0x65aa26
cmp byte [ebp - 0x7a], 0
je 0x65acdd
mov eax, dword [ebp - 0x1c]
call fcn.006584c4
cmp byte [0x68a205], 0
je 0x65acf9
cmp byte [ebp - 0x17], 0
je 0x65acf9
mov edx, dword [ebp - 0x1c]
mov eax, 0x65bf88
call fcn.0064ab38
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
cmp dword [ebp - 0x6c], 0x32
jge 0x65ad12
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659da7
xor eax, eax
push ebp
push 0x65ad4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a1d0]
call fcn.00621fe0
mov eax, dword [0x68a1d0]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65ad57
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
mov edx, 0x63
call fcn.0058e0a0
push 0x65d4c8
lea eax, [ebp - 0x12c4]
push eax
mov ecx, 0x65d4fc
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65ae35
mov ecx, dword [ebp - 4]
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65ae35
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12c8]
push eax
lea edx, [ebp - 0x12cc]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x12cc]
mov edx, 0x65c378
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x58]
call fcn.0064d200
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65adf0
cmp byte [0x68a205], 0
je 0x65ae8d
cmp byte [0x68a275], 0
jne 0x65ae8d
push dword [0x68a25c]
push 0x65bf34
lea ecx, [ebp - 0x12d4]
mov edx, 0x65bf44
mov eax, dword [0x68a24c]
call fcn.00429128
push dword [ebp - 0x12d4]
lea eax, [ebp - 0x12d0]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x12d0]
mov eax, 0x65bf88
call fcn.0064ab38
push 0
mov ecx, 0x65c1b0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65b8f2
push 0
mov ecx, 0x65d510
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x65afcc
push 0x65cc54
lea eax, [ebp - 0x12d8]
push eax
mov ecx, 0x65cc88
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
cmp byte [0x68a206], 0
je 0x65af1d
mov word [ebp - 0x86], 0
jmp 0x65af26
mov word [ebp - 0x86], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65d534
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x65af53
lea eax, [ebp - 0xc]
mov edx, 0x65d564
call fcn.0040b89c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x65af76
mov eax, dword [ebp - 0xc4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jle 0x65afcc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x65afcc
mov word [ebp - 0x86], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x65afb4
mov eax, dword [ebp - 0xc8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc8]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c3d0
push 0
mov ecx, 0x65d510
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x65aff1
dec eax
je 0x65b11e
jmp 0x65b2d7
push 0
lea eax, [ebp - 0x12e0]
push eax
mov ecx, 0x65d59c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x12e0]
lea eax, [ebp - 0x12dc]
mov edx, 0x65d5c4
call fcn.0040c260
mov eax, dword [ebp - 0x12dc]
lea edx, [ebp - 8]
call fcn.00648370
lea edx, [ebp - 0x12e4]
mov eax, dword [ebp - 8]
call fcn.00644f84
mov eax, dword [ebp - 0x12e4]
mov dl, 1
call fcn.00428a24
test al, al
jne 0x65b05f
lea eax, [ebp - 8]
mov edx, dword [0x68a234]
call fcn.0040b89c
lea edx, [ebp - 0x12e8]
mov eax, dword [ebp - 8]
call fcn.00644f84
mov eax, dword [ebp - 0x12e8]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65b112
lea edx, [ebp - 0x12ec]
mov eax, 0x65d5ec
call fcn.00648370
mov eax, dword [ebp - 0x12ec]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65b112
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65d628
push dword [ebp - 8]
push 0x65d63c
push dword [ebp - 0xc]
lea eax, [ebp - 0x12f4]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x12f4]
lea edx, [ebp - 0x12f0]
call fcn.00648370
mov eax, dword [ebp - 0x12f0]
push eax
lea edx, [ebp - 0x12f8]
mov eax, 0x65d5ec
call fcn.00648370
mov eax, dword [ebp - 0x12f8]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055aff4
pop edx
pop ecx
call fcn.00651ed4
jmp 0x65b2d7
mov byte [0x68a20d], 1
jmp 0x65b2d7
push 0
lea eax, [ebp - 0x12fc]
push eax
mov ecx, 0x65d59c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x12fc]
lea edx, [ebp - 8]
call fcn.00648370
cmp dword [ebp - 8], 0
je 0x65b2d0
lea edx, [ebp - 0x1300]
mov eax, dword [ebp - 8]
call fcn.006580ec
cmp dword [ebp - 0x1300], 0
je 0x65b2d0
lea edx, [ebp - 0x1304]
mov eax, 0x65d650
call fcn.00648370
mov eax, dword [ebp - 0x1304]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65b2d0
push 1
push 1
push 0
push 0x65d698
push dword [ebp - 8]
push 0x65d6b0
lea edx, [ebp - 0x1310]
mov eax, dword [ebp - 8]
call fcn.006580ec
push dword [ebp - 0x1310]
push 0x65d6e8
lea eax, [ebp - 0x130c]
mov edx, 5
call fcn.0040c2e8
mov eax, dword [ebp - 0x130c]
lea edx, [ebp - 0x1308]
call fcn.00648370
mov eax, dword [ebp - 0x1308]
push eax
lea edx, [ebp - 0x1314]
mov eax, 0x65d650
call fcn.00648370
mov eax, dword [ebp - 0x1314]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055aff4
pop edx
pop ecx
call fcn.00651ed4
test al, al
je 0x65b2c7
mov eax, dword [0x68a230]
mov edx, 0x65cd94
call fcn.0040c398
je 0x65b2be
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65d6f8
lea edx, [ebp - 0x1320]
mov eax, dword [ebp - 8]
call fcn.006580ec
push dword [ebp - 0x1320]
push 0x65d63c
push dword [ebp - 0xc]
lea eax, [ebp - 0x131c]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x131c]
lea edx, [ebp - 0x1318]
call fcn.00648370
mov eax, dword [ebp - 0x1318]
push eax
lea edx, [ebp - 0x1324]
mov eax, 0x65d5ec
call fcn.00648370
mov eax, dword [ebp - 0x1324]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055aff4
pop edx
pop ecx
call fcn.00651ed4
test al, al
jne 0x65b2d7
mov byte [0x68a20d], 1
jmp 0x65b2d7
mov byte [0x68a20d], 1
jmp 0x65b2d7
mov byte [0x68a20d], 1
jmp 0x65b2d7
mov byte [0x68a20d], 1
mov eax, dword [0x682650]
mov eax, dword [eax]
mov eax, dword [eax + 0x40c]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x65b3c2
push 0x65d72c
lea eax, [ebp - 0x1328]
push eax
mov ecx, 0x65d76c
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1328]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov ecx, dword [ebp - 4]
mov edx, 0x65d77c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65b3a6
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x132c]
push eax
lea ecx, [ebp - 0x1330]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1330]
mov edx, 0x65d77c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x132c]
call fcn.0064ffdc
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b361
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov edx, 0x65d7a0
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65b492
push 0x65d7c0
lea eax, [ebp - 0x1334]
push eax
mov ecx, 0x65d808
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1334]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov ecx, dword [ebp - 4]
mov edx, 0x65d7a0
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65b492
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68a20e], 0
jne 0x65b492
push 0
lea eax, [ebp - 0x1338]
push eax
lea edx, [ebp - 0x133c]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x133c]
mov edx, 0x65d7a0
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1338]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
test al, al
je 0x65b492
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b440
push 0x65d4c8
lea eax, [ebp - 0x1340]
push eax
mov ecx, 0x65d4fc
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1340]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov eax, 0x68a250
call fcn.0040b464
mov edx, 0x65d818
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65b567
mov ecx, dword [ebp - 4]
mov edx, 0x65d818
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65b567
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1344]
push eax
lea edx, [ebp - 0x1348]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1348]
mov edx, 0x65d818
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1344]
mov eax, dword [ebp - 0x58]
call fcn.0064f90c
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b522
push 0
mov ecx, 0x65cacc
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65b5e1
push 0xffffffffffffffff
mov ecx, 0x65caf8
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jne 0x65b5e1
cmp byte [0x68a20b], 0
je 0x65b5b3
lea eax, [ebp - 8]
mov edx, 0x65d82c
call fcn.0040b89c
jmp 0x65b5c0
lea eax, [ebp - 8]
mov edx, 0x65d858
call fcn.0040b89c
lea eax, [ebp - 0x134c]
mov ecx, 0x65d884
mov edx, dword [ebp - 8]
call fcn.0040c260
mov edx, dword [ebp - 0x134c]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
mov eax, dword [0x682650]
mov eax, dword [eax]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x65b650
cmp byte [0x68a20b], 0
je 0x65b612
lea eax, [ebp - 8]
mov edx, 0x65d82c
call fcn.0040b89c
jmp 0x65b61f
lea eax, [ebp - 8]
mov edx, 0x65d858
call fcn.0040b89c
push dword [ebp - 8]
push 0x65d974
push dword [0x68a22c]
push 0x65d9f4
lea eax, [ebp - 0x1350]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1350]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
mov edx, 0x65da28
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65b722
mov ecx, dword [ebp - 4]
mov edx, 0x65da28
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65b6df
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1354]
push eax
lea edx, [ebp - 0x1358]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1358]
mov edx, 0x65da28
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x58]
call fcn.00650e68
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b69a
xor eax, eax
push ebp
push 0x65b718
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0x1388
push 2
push 0x65da44
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b722
mov edx, 0x65da68
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65b7ad
mov ecx, dword [ebp - 4]
mov edx, 0x65da68
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65b7ad
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x135c]
push eax
lea edx, [ebp - 0x1360]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1360]
mov edx, 0x65da68
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x135c]
mov eax, dword [ebp - 0x58]
call fcn.006531ac
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b768
mov edx, 0x65da84
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65b8f2
mov ecx, dword [ebp - 4]
mov edx, 0x65da84
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65b8f2
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1364]
push eax
lea edx, [ebp - 0x1368]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1368]
mov edx, 0x65da84
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x1364]
mov dx, 4
mov eax, dword [ebp - 0x58]
call fcn.00655014
cmp byte [0x68a278], 0
je 0x65b865
mov byte [0x68a20d], 1
cmp byte [0x68a204], 0
je 0x65b85e
mov eax, dword [0x68a2ac]
push eax
call dword [0x68a2a8]
push ebp
call fcn.00658604
pop ecx
push 0
lea eax, [ebp - 0x136c]
push eax
lea edx, [ebp - 0x1370]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x1370]
mov edx, 0x65da84
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x136c]
mov dx, 5
mov eax, dword [ebp - 0x58]
call fcn.00655014
push 0x65d4c8
lea eax, [ebp - 0x1374]
push eax
mov ecx, 0x65d4fc
mov edx, 0x65bea8
mov eax, dword [0x68a1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1374]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005513e8
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65b7fb
cmp dword [0x68a22c], 0
je 0x65ba6f
lea edx, [ebp - 0x1378]
mov eax, dword [0x68a22c]
call fcn.00644f84
mov eax, dword [ebp - 0x1378]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65ba6f
push 0
mov ecx, 0x65daa4
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65b9d7
lea edx, [ebp - 0x137c]
mov eax, dword [0x68a22c]
call fcn.0042936c
mov ecx, dword [ebp - 0x137c]
lea eax, [ebp - 8]
mov edx, 0x65dad0
call fcn.0040c260
push dword [ebp - 8]
push 0x65db60
push dword [0x68a22c]
push 0x65d9f4
lea eax, [ebp - 0x1380]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1380]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
push dword [ebp - 8]
push 0x65db88
lea edx, [ebp - 0x1388]
mov eax, dword [0x68a22c]
call fcn.00429248
push dword [ebp - 0x1388]
push 0x65d9f4
lea eax, [ebp - 0x1384]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1384]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
mov eax, 0x65dbb8
call fcn.00644e7c
test al, al
je 0x65ba23
push 0x65dbe0
lea edx, [ebp - 0x1390]
mov eax, dword [0x68a22c]
call fcn.0042936c
push dword [ebp - 0x1390]
push 0x65dc44
lea eax, [ebp - 0x138c]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x138c]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
mov eax, 0x65dca8
call fcn.00644e7c
test al, al
je 0x65ba6f
push 0x65dbe0
lea edx, [ebp - 0x1398]
mov eax, dword [0x68a22c]
call fcn.0042936c
push dword [ebp - 0x1398]
push 0x65dccc
lea eax, [ebp - 0x1394]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x1394]
mov eax, dword [ebp - 0x58]
call fcn.0064e7e8
cmp byte [0x68a204], 0
je 0x65baa6
xor eax, eax
push ebp
push 0x65ba9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a2ac]
push eax
call dword [0x68a2a8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65baa6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
mov edx, 0x64
call fcn.0058e0a0
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
cmp byte [0x68a205], 0
je 0x65baed
push 0
mov ecx, 0x65dd2c
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65baed
call fcn.00657200
xor eax, eax
push ebp
push 0x65bb17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a288]
call fcn.00409674
mov eax, dword [ebp - 4]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bb21
cmp byte [0x68a27a], 0
je 0x65bb4e
mov eax, dword [0x68a25c]
call fcn.00658184
test al, al
jne 0x65bb4e
push 0
mov ecx, 0x65c464
mov edx, 0x65c104
mov eax, dword [0x68a200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
push ebp
push 0x65bb7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a200]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x68a200]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bb84
cmp byte [0x68a205], 0
je 0x65bc18
push 0
push dword [0x68a25c]
push 0x65bf34
lea ecx, [ebp - 0x13a4]
mov edx, 0x65bf44
mov eax, dword [0x68a24c]
call fcn.00429128
push dword [ebp - 0x13a4]
lea eax, [ebp - 0x13a0]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x13a0]
lea edx, [ebp - 0x139c]
call fcn.00644f84
mov eax, dword [ebp - 0x139c]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13a8]
mov ecx, 0x65bf5c
mov edx, dword [0x68a228]
call fcn.0040c260
mov eax, dword [ebp - 0x13a8]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65bc18
mov byte [0x68a20d], 1
cmp byte [0x68a205], 0
jne 0x65bcd7
push 0
mov ecx, 0x65c284
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65bcd7
lea eax, [ebp - 0x13b0]
mov ecx, 0x65dd54
mov edx, dword [0x68a25c]
call fcn.0040c260
mov eax, dword [ebp - 0x13b0]
lea edx, [ebp - 0x13ac]
call fcn.00644f84
mov eax, dword [ebp - 0x13ac]
mov dl, 1
call fcn.00428a24
test al, al
jne 0x65bcd7
push 0
lea eax, [ebp - 0x13b8]
mov ecx, 0x65dd54
mov edx, dword [0x68a25c]
call fcn.0040c260
mov eax, dword [ebp - 0x13b8]
lea edx, [ebp - 0x13b4]
call fcn.00644f84
mov eax, dword [ebp - 0x13b4]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13bc]
mov ecx, 0x65bf5c
mov edx, dword [0x68a228]
call fcn.0040c260
mov eax, dword [ebp - 0x13bc]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x65c284
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65bd83
push 0
mov ecx, 0x65cacc
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65bd83
push 0xffffffffffffffff
mov ecx, 0x65caf8
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x65bd83
push 5
push 0
push 1
lea edx, [ebp - 0x13c4]
mov eax, dword [ebp - 0x60]
call fcn.00427d80
mov ecx, dword [ebp - 0x13c4]
lea eax, [ebp - 0x13c0]
mov edx, 0x65dd7c
call fcn.0040c260
mov eax, dword [ebp - 0x13c0]
push eax
lea eax, [ebp - 0x13c8]
mov ecx, 0x65dda8
mov edx, dword [0x68a25c]
call fcn.0040c260
mov edx, dword [ebp - 0x13c8]
xor eax, eax
pop ecx
call fcn.00651ed4
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
mov byte [0x68a277], 1
mov byte [0x68a20f], 0
cmp byte [0x68a206], 0
jne 0x65bdc7
push 0
mov ecx, 0x65ddd0
mov edx, 0x65bf1c
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65bdc7
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65be37
lea eax, [ebp - 0x13c8]
mov edx, 0x64
call fcn.0040b4c4
lea eax, [ebp - 0x1238]
mov edx, 0x24
call fcn.0040b4c4
lea eax, [ebp - 0x11a0]
mov edx, 0x36
call fcn.0040b4c4
lea eax, [ebp - 0x52]
mov edx, dword [0x61a760]
call fcn.0040cb78
lea eax, [ebp - 0x1c]
mov edx, dword [0x6585a4]
call fcn.0040cb78
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b4c4
pop eax
jmp eax