Function at 0x656e2c
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x270
push 0
push 0
dec ecx
jne 0x656e34
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x656c94]
call fcn.0040a96c
lea eax, [ebp - 0x52]
mov edx, dword [0x61d498]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x65a083
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48fe5c]
call fcn.004b380c
mov dword [0x685954], eax
mov byte [0x6858ed], 0
mov byte [0x6858ec], 0
mov byte [0x6858ee], 1
push 0x65a0a0
lea eax, [ebp - 0x1094]
push eax
mov ecx, 0x65a0c8
mov edx, 0x65a0dc
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1094]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
push 0x65a0f8
lea eax, [ebp - 0x109c]
push eax
mov ecx, 0x65a124
mov edx, 0x65a134
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x109c]
lea edx, [ebp - 0x1098]
call fcn.00648f98
mov edx, dword [ebp - 0x1098]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3c0]
call fcn.0054191c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3c8]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b8]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3bc]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3cc]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d0]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d4]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3d8]
call fcn.00541f24
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
xor edx, edx
call fcn.0057650c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.00541f2c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
lea edx, [ebp - 0x10a4]
mov eax, dword [0x68592c]
call fcn.00422c30
mov eax, dword [ebp - 0x10a4]
lea edx, [ebp - 0x10a0]
call fcn.0042b5ec
mov edx, dword [ebp - 0x10a0]
mov eax, 0x68592c
call fcn.0040994c
push 0
lea eax, [ebp - 0x10ac]
push eax
mov ecx, 0x65a150
mov edx, 0x65a17c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10ac]
lea edx, [ebp - 0x10a8]
call fcn.00648f98
mov edx, dword [ebp - 0x10a8]
mov eax, 0x685908
call fcn.0040994c
xor eax, eax
mov dword [0x68595c], eax
xor eax, eax
mov dword [0x685960], eax
xor eax, eax
mov dword [0x685964], eax
xor eax, eax
mov dword [0x685968], eax
xor eax, eax
mov dword [0x68596c], eax
cmp byte [0x68594a], 0
je 0x6571ac
push dword [0x68592c]
push 0x65a194
push dword [0x685940]
lea eax, [ebp - 0x10b0]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10b0]
mov dl, 1
call fcn.004241f0
test al, al
je 0x6571ac
push 0
lea eax, [ebp - 0x10b4]
mov ecx, 0x65a1a4
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x10b4]
call fcn.0040a13c
push eax
push dword [0x68592c]
push 0x65a1d0
push dword [0x685940]
lea eax, [ebp - 0x10b8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10b8]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x6571df
lea eax, [ebp - 0x10bc]
mov ecx, 0x65a1e0
mov edx, dword [0x685904]
call fcn.0040a390
mov ecx, dword [ebp - 0x10bc]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a8dc
mov dword [0x6858e0], eax
mov ecx, dword [0x685954]
mov edx, 0x65a20c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x685954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68595c], eax
mov ecx, dword [0x685954]
mov edx, 0x65a224
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x685954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x685960], eax
mov ecx, dword [0x685954]
mov edx, 0x65a240
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x685954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x685964], eax
mov ecx, dword [0x685954]
mov edx, 0x65a268
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x685954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x685968], eax
mov ecx, dword [0x685954]
mov edx, 0x65a294
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x685954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68596c], eax
jmp 0x6571df
call fcn.00430958
push eax
lea eax, [ebp - 0x10c0]
mov ecx, 0x65a2b4
mov edx, dword [0x685904]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c0]
mov dl, 1
mov eax, dword [0x507730]
call fcn.0050a914
mov dword [0x6858e0], eax
push 0
mov ecx, 0x65a2e0
mov edx, 0x65a304
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x657216
push 0
mov ecx, 0x65a31c
mov edx, 0x65a344
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
je 0x657b4a
lea edx, [ebp - 0x10c4]
mov al, 0x1c
call fcn.00646c70
mov eax, dword [ebp - 0x10c4]
push eax
mov ecx, 0x65a35c
mov edx, 0x65a378
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x10c8]
mov al, 0x1d
call fcn.00646c70
mov eax, dword [ebp - 0x10c8]
push eax
mov ecx, 0x65a394
mov edx, 0x65a3b8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10d0]
push eax
mov ecx, 0x65a3d4
mov edx, 0x65a3e4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10d0]
lea edx, [ebp - 0x10cc]
call fcn.00648f98
mov eax, dword [ebp - 0x10cc]
push eax
mov ecx, 0x65a404
mov edx, 0x65a414
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
lea eax, [ebp - 8]
call fcn.0040956c
push 0
mov ecx, 0x65a434
mov edx, 0x65a450
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65733a
push 0
mov ecx, 0x65a468
mov edx, 0x65a480
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65733a
lea eax, [ebp - 8]
mov edx, 0x65a498
call fcn.00409994
push 0
mov ecx, 0x65a554
mov edx, 0x65a56c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65733a
cmp dword [0x6858b4], 0
jne 0x657329
cmp dword [0x6858b0], 0xe4e1c0
jbe 0x65733a
jmp 0x65732b
jle 0x65733a
mov edx, 0x65a584
mov eax, dword [0x68589c]
call fcn.0054191c
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x65a5e4
mov edx, 0x65a5f4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.00648f98
mov ecx, dword [ebp - 0x10d8]
lea eax, [ebp - 0x10d4]
mov edx, dword [ebp - 8]
call fcn.0040a390
mov eax, dword [ebp - 0x10d4]
push eax
mov ecx, 0x65a614
mov edx, 0x65a624
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10e4]
push eax
mov ecx, 0x65a644
mov edx, 0x65a654
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x10e0]
call fcn.00648f98
mov eax, dword [ebp - 0x10e0]
push eax
mov ecx, 0x65a674
mov edx, 0x65a684
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10ec]
push eax
mov ecx, 0x65a6a4
mov edx, 0x65a6b4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10ec]
lea edx, [ebp - 0x10e8]
call fcn.00648f98
mov eax, dword [ebp - 0x10e8]
push eax
mov ecx, 0x65a6d4
mov edx, 0x65a6e4
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f4]
push eax
mov ecx, 0x65a704
mov edx, 0x65a714
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f4]
lea edx, [ebp - 0x10f0]
call fcn.00648f98
mov eax, dword [ebp - 0x10f0]
push eax
mov ecx, 0x65a734
mov edx, 0x65a744
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10fc]
push eax
mov ecx, 0x65a764
mov edx, 0x65a774
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10fc]
lea edx, [ebp - 0x10f8]
call fcn.00648f98
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, 0x65a794
mov edx, 0x65a7a4
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1104]
push eax
mov ecx, 0x65a7c4
mov edx, 0x65a7d4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1104]
lea edx, [ebp - 0x1100]
call fcn.00648f98
mov eax, dword [ebp - 0x1100]
push eax
mov ecx, 0x65a7f4
mov edx, 0x65a804
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x65a824
mov edx, 0x65a834
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x110c]
lea edx, [ebp - 0x1108]
call fcn.00648f98
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x65a854
mov edx, 0x65a864
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x65a884
mov edx, 0x65a894
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00648f98
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x65a8b4
mov edx, 0x65a8c4
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x111c]
push eax
mov ecx, 0x65a8e4
mov edx, 0x65a8f4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x111c]
lea edx, [ebp - 0x1118]
call fcn.00648f98
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x65a914
mov edx, 0x65a924
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1124]
push eax
mov ecx, 0x65a944
mov edx, 0x65a954
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00648f98
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, 0x65a970
mov edx, 0x65a980
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x112c]
push eax
mov ecx, 0x65a99c
mov edx, 0x65a9ac
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.00648f98
mov eax, dword [ebp - 0x1128]
push eax
mov ecx, 0x65a9c8
mov edx, 0x65a9d8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1134]
push eax
mov ecx, 0x65a9f4
mov edx, 0x65aa04
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1134]
lea edx, [ebp - 0x1130]
call fcn.00648f98
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x65aa20
mov edx, 0x65aa30
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x113c]
push eax
mov ecx, 0x65aa4c
mov edx, 0x65aa5c
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x113c]
lea edx, [ebp - 0x1138]
call fcn.00648f98
mov eax, dword [ebp - 0x1138]
push eax
mov ecx, 0x65aa78
mov edx, 0x65aa88
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1144]
push eax
mov ecx, 0x65aaa4
mov edx, 0x65aab4
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1144]
lea edx, [ebp - 0x1140]
call fcn.00648f98
mov eax, dword [ebp - 0x1140]
push eax
mov ecx, 0x65aad0
mov edx, 0x65aae0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x114c]
push eax
mov ecx, 0x65aafc
mov edx, 0x65ab0c
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x114c]
lea edx, [ebp - 0x1148]
call fcn.00648f98
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65ab28
mov edx, 0x65ab38
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1154]
push eax
mov ecx, 0x65ab54
mov edx, 0x65ab64
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1154]
lea edx, [ebp - 0x1150]
call fcn.00648f98
mov eax, dword [ebp - 0x1150]
push eax
mov ecx, 0x65ab80
mov edx, 0x65ab90
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x65abac
mov edx, 0x65abbc
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00648f98
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65abd8
mov edx, 0x65abe8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1164]
push eax
mov ecx, 0x65ac04
mov edx, 0x65ac14
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00648f98
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x65ac30
mov edx, 0x65ac40
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x116c]
push eax
mov ecx, 0x65ac5c
mov edx, 0x65ac6c
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x116c]
lea edx, [ebp - 0x1168]
call fcn.00648f98
mov eax, dword [ebp - 0x1168]
push eax
mov ecx, 0x65ac88
mov edx, 0x65ac98
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1174]
push eax
mov ecx, 0x65acb4
mov edx, 0x65acc8
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1174]
lea edx, [ebp - 0x1170]
call fcn.00648f98
mov eax, dword [ebp - 0x1170]
push eax
mov ecx, 0x65ace4
mov edx, 0x65acf8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x117c]
push eax
mov ecx, 0x65ad14
mov edx, 0x65ad28
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x117c]
lea edx, [ebp - 0x1178]
call fcn.00648f98
mov eax, dword [ebp - 0x1178]
push eax
mov ecx, 0x65ad44
mov edx, 0x65ad58
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1184]
push eax
mov ecx, 0x65ad74
mov edx, 0x65ad88
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1184]
lea edx, [ebp - 0x1180]
call fcn.00648f98
mov eax, dword [ebp - 0x1180]
push eax
mov ecx, 0x65ada4
mov edx, 0x65adb8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x65add4
mov edx, 0x65ade8
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x118c]
lea edx, [ebp - 0x1188]
call fcn.00648f98
mov eax, dword [ebp - 0x1188]
push eax
mov ecx, 0x65ae04
mov edx, 0x65ae18
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65ae34
mov edx, 0x65ae48
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00648f98
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x65ae64
mov edx, 0x65ae78
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x119c]
push eax
mov ecx, 0x65ae94
mov edx, 0x65aea8
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x119c]
lea edx, [ebp - 0x1198]
call fcn.00648f98
mov eax, dword [ebp - 0x1198]
push eax
mov ecx, 0x65aec4
mov edx, 0x65aed8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11a4]
push eax
mov ecx, 0x65aef4
mov edx, 0x65af08
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11a4]
lea edx, [ebp - 0x11a0]
call fcn.00648f98
mov eax, dword [ebp - 0x11a0]
push eax
mov ecx, 0x65af24
mov edx, 0x65af38
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65af54
mov edx, 0x65af68
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ac]
lea edx, [ebp - 0x11a8]
call fcn.00648f98
mov eax, dword [ebp - 0x11a8]
push eax
mov ecx, 0x65af84
mov edx, 0x65af98
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11b4]
push eax
mov ecx, 0x65afb4
mov edx, 0x65afc8
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11b0]
call fcn.00648f98
mov eax, dword [ebp - 0x11b0]
push eax
mov ecx, 0x65afe4
mov edx, 0x65aff8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x11b8]
mov al, 0x37
call fcn.00646c70
mov eax, dword [ebp - 0x11b8]
push eax
mov ecx, 0x65b014
mov edx, 0x65b02c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
movzx eax, byte [0x6858eb]
push eax
mov ecx, 0x65b048
mov edx, 0x65b06c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x6858e8]
push eax
mov ecx, 0x65b088
mov edx, 0x65b0a0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x6858e4]
push eax
mov ecx, 0x65b0bc
mov edx, 0x65b0d0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [0x68592c]
push eax
mov ecx, 0x65b0ec
mov edx, 0x65b110
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [0x685908], 0
je 0x657c03
mov eax, dword [0x685908]
push eax
mov ecx, 0x65b12c
mov edx, 0x65b158
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [0x685930]
push eax
mov ecx, 0x65b174
mov edx, 0x65b1a0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x6858e5], 0
je 0x657e7c
push 0
mov ecx, 0x65b1bc
mov edx, 0x65b1e8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b200
mov edx, 0x65b224
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65b240
mov edx, 0x65b26c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b284
mov edx, 0x65b2b0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65b2cc
mov edx, 0x65b2fc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b314
mov edx, 0x65b344
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65b360
mov edx, 0x65b390
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657d10
push 0
lea eax, [ebp - 0x11c0]
push eax
mov ecx, 0x65b3a8
mov edx, 0x65b3e8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11c0]
lea edx, [ebp - 0x11bc]
call fcn.00648f98
mov eax, dword [ebp - 0x11bc]
push eax
mov ecx, 0x65b400
mov edx, 0x65b440
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x657d26
push 0
mov ecx, 0x65b45c
mov edx, 0x65b49c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65b4b8
mov edx, 0x65b4ec
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657d8b
push 0
lea eax, [ebp - 0x11c8]
push eax
mov ecx, 0x65b504
mov edx, 0x65b52c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11c8]
lea edx, [ebp - 0x11c4]
call fcn.00648f98
mov eax, dword [ebp - 0x11c4]
push eax
mov ecx, 0x65b544
mov edx, 0x65b56c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x657da1
push 0
mov ecx, 0x65b588
mov edx, 0x65b5b0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65b5cc
mov edx, 0x65b5f4
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b60c
mov edx, 0x65b634
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65b650
mov edx, 0x65b680
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657e7c
push 0
lea eax, [ebp - 0x11d0]
push eax
mov ecx, 0x65b698
mov edx, 0x65b6d0
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d0]
lea edx, [ebp - 0x11cc]
call fcn.00648f98
mov eax, dword [ebp - 0x11cc]
push eax
mov ecx, 0x65b6e8
mov edx, 0x65b708
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11d8]
push eax
mov ecx, 0x65b724
mov edx, 0x65b75c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d8]
lea edx, [ebp - 0x11d4]
call fcn.00648f98
mov eax, dword [ebp - 0x11d4]
push eax
mov ecx, 0x65b774
mov edx, 0x65b79c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65b7b8
mov edx, 0x65b7d4
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6580c3
push 0
mov ecx, 0x65b7ec
mov edx, 0x65b814
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b82c
mov edx, 0x65b854
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11e0]
push eax
mov ecx, 0x65b870
mov edx, 0x65b890
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e0]
lea edx, [ebp - 0x11dc]
call fcn.00648f98
mov eax, dword [ebp - 0x11dc]
push eax
mov ecx, 0x65b8a8
mov edx, 0x65b8c8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65b8e4
mov edx, 0x65b914
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b92c
mov edx, 0x65b95c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65b978
mov edx, 0x65b9ac
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65b9c4
mov edx, 0x65b9f8
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65ba14
mov edx, 0x65ba48
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65ba60
mov edx, 0x65ba94
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65bab0
mov edx, 0x65badc
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65baf4
mov edx, 0x65bb20
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65bb3c
mov edx, 0x65bb68
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x658001
push 0xffffffffffffffff
mov ecx, 0x65bb80
mov edx, 0x65bbac
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push eax
mov ecx, 0x65bbc4
mov edx, 0x65bbf0
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
jmp 0x658017
push 0
mov ecx, 0x65bc0c
mov edx, 0x65bc38
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
mov ecx, 0x65bc54
mov edx, 0x65bc84
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65bc9c
mov edx, 0x65bccc
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11e8]
push eax
mov ecx, 0x65bce8
mov edx, 0x65bd18
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e8]
lea edx, [ebp - 0x11e4]
call fcn.00648f98
mov eax, dword [ebp - 0x11e4]
push eax
mov ecx, 0x65bd30
mov edx, 0x65bd60
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11ec]
push eax
mov ecx, 0x65bd7c
mov edx, 0x65bdac
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ec]
push eax
mov ecx, 0x65bdc4
mov edx, 0x65bdf4
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 8]
mov byte [0x68594f], 0
push 0
mov ecx, 0x65be10
mov edx, 0x65be3c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
jne 0x6580fb
mov dl, 1
mov eax, dword [0x68592c]
call fcn.00424288
test al, al
je 0x6580fb
mov byte [0x68594f], 1
cmp byte [0x6858e4], 0
je 0x65816c
xor eax, eax
push ebp
push 0x658162
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x685978], eax
push 0x65be48
push 0x65be88
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x685970], eax
push 0x65bea4
push 0x65be88
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x685974], eax
push 0x685978
call dword [0x685970]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65816c
push 0x3e8
call sub.kernel32.dll_Sleep_2
push 0x65beec
lea eax, [ebp - 0x11f0]
push eax
mov ecx, 0x65bf20
mov edx, 0x65bf34
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x11f0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
xor eax, eax
push ebp
push 0x658239
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x11f4]
xor eax, eax
call fcn.00406c04
mov ecx, dword [ebp - 0x11f4]
mov dl, 1
mov eax, dword [0x492cec]
call fcn.004b5ea0
mov dword [0x6858a0], eax
mov eax, dword [0x6858d0]
xor edx, edx
push edx
push eax
mov eax, dword [0x6858a0]
call fcn.004b38d8
push 0xff00
lea eax, [ebp - 0x11f8]
mov ecx, 0x65bf50
mov edx, dword [0x685904]
call fcn.0040a390
mov ecx, dword [ebp - 0x11f8]
mov dl, 1
mov eax, dword [0x492cec]
call fcn.004b5ea0
mov dword [0x6858a4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658297
xor esi, esi
mov eax, dword [0x6858d4]
sub eax, esi
cmp eax, 0x1000
jb 0x6582c0
lea edx, [ebp - 0x1090]
mov ecx, 0x1000
mov eax, dword [0x6858a0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x6582d4
mov ecx, eax
lea edx, [ebp - 0x1090]
mov eax, dword [0x6858a0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x1090]
mov ecx, ebx
mov eax, dword [0x6858a4]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x6858d4]
mov dword [ebp - 0x1200], eax
xor eax, eax
mov dword [ebp - 0x11fc], eax
fild qword [ebp - 0x1200]
fdivr dword [0x65bf70]
mov dword [ebp - 0x1200], esi
xor eax, eax
mov dword [ebp - 0x11fc], eax
fild qword [ebp - 0x1200]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.0057650c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
cmp ebx, 0x1000
je 0x658299
mov eax, dword [0x6858a4]
call fcn.004078f0
mov eax, dword [0x6858a0]
call fcn.004078f0
push 0x65bf80
lea eax, [ebp - 0x1204]
push eax
mov ecx, 0x65bfb0
mov edx, 0x65bfc0
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1204]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov dl, 1
mov eax, dword [0x61d7e8]
call fcn.00623938
mov dword [0x6858a8], eax
xor eax, eax
push ebp
push 0x6583ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1208]
mov ecx, 0x65bfdc
mov edx, dword [0x685904]
call fcn.0040a390
mov edx, dword [ebp - 0x1208]
mov cl, 1
mov eax, dword [0x6858a8]
call fcn.006239b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65844d
mov dl, 1
mov eax, dword [0x48fe5c]
call fcn.004b380c
mov dword [ebp - 4], eax
mov byte [ebp - 0x6f], 0
push 0
mov ecx, 0x65c008
mov edx, 0x65c02c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x6c], eax
push 0
mov ecx, 0x65c044
mov edx, 0x65c070
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65849d
mov eax, 0x65c088
call fcn.00589f14
mov byte [0x6858f0], 0
mov byte [0x6858f1], 0
lea eax, [ebp - 0x10]
call fcn.0040956c
push 0
mov ecx, 0x65c0dc
mov edx, 0x65c100
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x6858f4], eax
push 0
mov ecx, 0x65c118
mov edx, 0x65c13c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x6858f8], eax
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ec]
cmp byte [eax + 0x69], 0
je 0x658611
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x658611
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov edx, dword [ebp - 0x60]
call fcn.0064025c
test al, al
jne 0x658605
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.00656ad8
cmp dword [ebp - 8], 0
je 0x658605
lea edx, [ebp - 0x120c]
mov eax, dword [ebp - 8]
call fcn.00422824
mov edx, dword [ebp - 0x120c]
lea eax, [ebp - 8]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, 0x65c154
call fcn.0040a4c8
jne 0x658597
mov byte [0x6858f0], 1
jmp 0x658605
mov eax, dword [ebp - 8]
mov edx, 0x65c178
call fcn.0040a4c8
jne 0x6585af
mov byte [0x6858f1], 1
jmp 0x658605
mov eax, dword [ebp - 8]
mov edx, 0x65c19c
call fcn.0040a4c8
jne 0x6585ce
mov byte [0x6858f0], 1
mov byte [0x6858f1], 1
jmp 0x658605
mov eax, dword [ebp - 8]
mov edx, 0x65c1bc
call fcn.0040a4c8
jne 0x6585ed
mov byte [0x6858f0], 1
mov byte [0x6858f1], 1
jmp 0x658605
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65c1e0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040a418
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x65852c
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x6e]
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x6590ec
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x6858ed], 0
je 0x658640
push ebp
call fcn.00656cf4
pop ecx
cmp byte [0x6858f0], 0
je 0x658658
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x6858f4]
jl 0x6590e0
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1210]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x1210]
mov edx, 0x65c1f0
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 8], 0
je 0x6590e0
push 0x65c208
push dword [0x685924]
push 0x65c230
lea eax, [ebp - 0x1214]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1214]
mov eax, dword [ebp - 8]
call fcn.0040a4c8
je 0x6590e0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65c244
call fcn.0040a710
test eax, eax
je 0x6590e0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65c254
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
cmp byte [0x6858f1], 0
je 0x658726
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x6858f4]
jl 0x658726
mov eax, dword [ebp - 0x1c]
mov edx, 0x65c264
call fcn.0040a4c8
jne 0x6590e0
cmp byte [ebp - 0x6e], 0
je 0x6587da
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00409994
jmp 0x6587b7
lea eax, [ebp - 0x1218]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65c2a4
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1218]
push eax
lea edx, [ebp - 0x121c]
mov eax, dword [ebp - 0x1c]
call fcn.00422824
mov edx, dword [ebp - 0x121c]
mov ecx, 1
pop eax
call fcn.0040a710
test eax, eax
jle 0x658796
mov bl, 1
jmp 0x6587d1
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65c2b4
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65c2c4
call fcn.0040a710
test eax, eax
jg 0x65873f
cmp bl, 1
je 0x6590e0
lea edx, [ebp - 0x1220]
mov eax, dword [ebp - 0x1c]
call fcn.00648f98
mov edx, dword [ebp - 0x1220]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65c2d4
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.0040a548
mov eax, dword [ebp - 8]
test eax, eax
je 0x658823
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x6590e0
lea eax, [ebp - 0x1224]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x1224]
mov edx, 1
call fcn.00423860
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65c2e4
call fcn.0040a710
test eax, eax
jne 0x6588ce
xor eax, eax
push ebp
push 0x6588c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1228]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x1228]
mov eax, dword [0x6858a8]
call fcn.00625370
mov edx, eax
lea ecx, [ebp - 0x52]
mov eax, dword [0x6858a8]
call fcn.006228d4
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6588ce
fild dword [ebp - 0x6c]
fdivr dword [0x65bf70]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
call fcn.0057650c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65c30c
call fcn.0040a710
test eax, eax
jne 0x658b6e
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x658b6e
cmp byte [0x6858e6], 0
je 0x65893c
cmp byte [ebp - 0x18], 0
jne 0x65893c
mov byte [ebp - 0x18], 1
cmp byte [ebp - 0x6f], 0
jne case.0x6589a7.0
cmp byte [ebp - 0x18], 0
jne case.0x6589a7.0
push 0
push 0
lea eax, [ebp - 0x1230]
push eax
mov ecx, 0x65c334
mov edx, 0x65c348
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1230]
lea ecx, [ebp - 0x122c]
mov edx, dword [ebp - 0x1c]
call fcn.00649bf8
mov eax, dword [ebp - 0x122c]
movzx ecx, word [0x65c35c]
xor edx, edx
call fcn.00589d7c
cmp eax, 0xe
ja case.0x6589a7.0
movzx eax, byte [eax + 0x6589ae]
jmp dword [eax*4 + 0x6589bd]
mov byte [ebp - 0x18], 1
jmp case.0x6589a7.0
mov byte [ebp - 0x18], 3
jmp case.0x6589a7.0
mov byte [ebp - 0x6f], 1
mov byte [ebp - 0x18], 1
jmp case.0x6589a7.0
mov byte [ebp - 0x6f], 3
mov byte [ebp - 0x18], 3
jmp case.0x6589a7.0
mov eax, dword [ebp - 0x58]
call fcn.0060d184
cmp byte [0x6858ed], 0
je 0x6590e0
mov eax, dword [0x6858a8]
call fcn.004078f0
push ebp
call fcn.00656cf4
pop ecx
jmp 0x6590e0
cmp byte [ebp - 0x18], 1
je 0x658a2c
cmp byte [ebp - 0x6f], 1
jne 0x658a56
xor eax, eax
push ebp
push 0x658a4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658a56
cmp byte [ebp - 0x18], 3
je 0x658a62
cmp byte [ebp - 0x6f], 3
jne 0x658a6f
mov eax, dword [ebp - 0x1c]
call fcn.006566c4
jmp 0x6590e0
cmp byte [ebp - 0x18], 2
jne 0x658b6e
push 0
lea edx, [ebp - 0x1234]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x1234]
mov ecx, dword [0x685904]
mov eax, dword [0x6858a8]
call fcn.00623f14
push dword [0x685904]
push 0x65c36c
lea edx, [ebp - 0x123c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
push dword [ebp - 0x123c]
lea eax, [ebp - 0x1238]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1238]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00656510
test al, al
je 0x658b27
mov eax, dword [ebp - 0x1c]
call fcn.00424884
push dword [0x685904]
push 0x65c37c
lea edx, [ebp - 0x1244]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
push dword [ebp - 0x1244]
lea eax, [ebp - 0x1240]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1240]
call fcn.00424884
jmp 0x658b6e
push dword [0x685904]
push 0x65c38c
lea edx, [ebp - 0x124c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
push dword [ebp - 0x124c]
lea eax, [ebp - 0x1248]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1248]
call fcn.00424884
mov eax, dword [ebp - 0x1c]
call fcn.006566c4
jmp 0x6590e0
lea eax, [ebp - 0x1250]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x1250]
mov edx, 0x65c39c
call fcn.0040a4c8
jne 0x658bd2
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x658ba5
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65c3b0
call fcn.0040a710
add eax, 3
jmp 0x658bd7
mov eax, 3
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x658c00
mov eax, dword [ebp - 0x88]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
sub edx, eax
jl 0x658de2
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x658dd6
lea eax, [ebp - 0x1254]
push eax
mov ebx, dword [ebp - 0x64]
dec ebx
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x1254]
mov dl, 1
call fcn.00424288
test al, al
jne 0x658dd6
xor eax, eax
push ebp
push 0x658c9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1258]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x1258]
call fcn.004069bc
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658d9f
cmp byte [0x6858e5], 0
je 0x658dd6
cmp byte [ebp - 0x17], 0
je 0x658dd6
lea eax, [ebp - 0x1274]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov edx, dword [ebp - 0x1274]
mov eax, 0x65c48c
call fcn.0064b410
inc dword [ebp - 0x64]
dec dword [ebp - 0x80]
jne 0x658c1b
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65c4a8
call fcn.0040a710
test eax, eax
jg 0x6590e0
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x658f21
lea edx, [ebp - 0x1278]
mov eax, dword [ebp - 0x1c]
call fcn.00424b50
mov eax, dword [ebp - 0x1278]
mov edx, 0x65c4d0
call fcn.0040a4c8
jne 0x658e5e
push 1
push 0
push 0x65c4e8
push 0x65c52c
push 0x65c53c
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004245bc
test eax, 1
jle 0x658ea1
xor eax, eax
push ebp
push 0x658e97
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x80
mov eax, dword [ebp - 0x1c]
call fcn.00424674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658ea1
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x1c]
call fcn.00424b8c
mov eax, dword [ebp - 0x1280]
lea edx, [ebp - 0x127c]
call fcn.00422824
mov eax, dword [ebp - 0x127c]
mov edx, 0x65c554
call fcn.0040a4c8
je 0x658f03
lea edx, [ebp - 0x1288]
mov eax, dword [ebp - 0x1c]
call fcn.00424b8c
mov eax, dword [ebp - 0x1288]
lea edx, [ebp - 0x1284]
call fcn.00422824
mov eax, dword [ebp - 0x1284]
mov edx, 0x65c56c
call fcn.0040a4c8
jne 0x658f21
mov eax, dword [ebp - 0x1c]
call fcn.006565c4
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov byte [ebp - 0x6d], 0
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x658f5d
xor eax, eax
push ebp
push 0x658f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00424884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658f5d
xor eax, eax
push ebp
push 0x658f9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x128c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov edx, dword [ebp - 0x128c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x6858a8]
call fcn.00623f40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659056
cmp byte [ebp - 0x6d], 0
jne 0x658f21
xor eax, eax
push ebp
push 0x659083
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x4a]
mov eax, dword [ebp - 0x1c]
call fcn.00424524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6590ab
cmp byte [0x6858e5], 0
je 0x6590c7
cmp byte [ebp - 0x17], 0
je 0x6590c7
mov edx, dword [ebp - 0x1c]
mov eax, 0x65c64c
call fcn.0064b410
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
cmp dword [ebp - 0x6c], 0x32
jge 0x6590e0
push 0x64
call sub.kernel32.dll_Sleep_2
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x658630
xor eax, eax
push ebp
push 0x659118
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6858a8]
call fcn.00623b28
mov eax, dword [0x6858a8]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659122
push 0x65c664
lea eax, [ebp - 0x12a0]
push eax
mov ecx, 0x65c698
mov edx, 0x65c6ac
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12a0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov ecx, dword [ebp - 4]
mov edx, 0x65c6c8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6591d1
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12a4]
push eax
lea ecx, [ebp - 0x12a8]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12a8]
mov edx, 0x65c6e8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12a4]
mov eax, dword [ebp - 0x58]
call fcn.0064cb04
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x65918c
cmp byte [0x6858e5], 0
je 0x659270
cmp byte [0x68594a], 0
jne 0x659270
push dword [0x68592c]
push 0x65c708
push dword [0x685924]
lea eax, [ebp - 0x12ac]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12ac]
mov eax, 0x65c718
call fcn.0064b410
push dword [0x68592c]
push 0x65c730
movzx eax, byte [0x65c734]
push eax
lea eax, [ebp - 0x12b4]
push eax
mov ecx, 0x65c744
mov edx, 0x65c75c
mov eax, dword [0x685924]
call fcn.0042b81c
push dword [ebp - 0x12b4]
lea eax, [ebp - 0x12b0]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12b0]
mov eax, 0x65c774
call fcn.0064b410
push 0
mov ecx, 0x65c78c
mov edx, 0x65c7a4
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x659be4
push 0
mov ecx, 0x65c7bc
mov edx, 0x65c7e0
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jle 0x6593a6
push 0x65c7f8
lea eax, [ebp - 0x12b8]
push eax
mov ecx, 0x65c82c
mov edx, 0x65c840
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12b8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
cmp byte [0x6858e6], 0
je 0x6592fd
mov word [ebp - 0x76], 0
jmp 0x659303
mov word [ebp - 0x76], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65c85c
mov edx, 0x65c88c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0xc], 0
jne 0x659330
lea eax, [ebp - 0xc]
mov edx, 0x65c8a4
call fcn.00409994
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x659353
mov eax, dword [ebp - 0x8c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jle 0x6593a6
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x6593a6
mov word [ebp - 0x76], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x65938e
mov eax, dword [ebp - 0x90]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x90]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040a500
push 0
mov ecx, 0x65c8dc
mov edx, 0x65c900
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
je 0x6593cb
dec eax
je 0x6594d3
jmp 0x659689
push 0
lea eax, [ebp - 0x12c0]
push eax
mov ecx, 0x65c918
mov edx, 0x65c940
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x12c0]
lea eax, [ebp - 0x12bc]
mov edx, 0x65c958
call fcn.0040a390
mov eax, dword [ebp - 0x12bc]
lea edx, [ebp - 8]
call fcn.00648f98
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f0
test al, al
jne 0x659428
lea eax, [ebp - 8]
mov edx, dword [0x685910]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f0
test al, al
je 0x6594c7
lea edx, [ebp - 0x12c4]
mov eax, 0x65c980
call fcn.00648f98
mov eax, dword [ebp - 0x12c4]
mov dl, 1
call fcn.004241f0
test al, al
je 0x6594c7
movzx eax, word [ebp - 0x76]
push eax
push 1
push 0
push 0x65c9bc
push dword [ebp - 8]
push 0x65c9d0
push dword [ebp - 0xc]
lea eax, [ebp - 0x12cc]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x12cc]
lea edx, [ebp - 0x12c8]
call fcn.00648f98
mov eax, dword [ebp - 0x12c8]
push eax
lea edx, [ebp - 0x12d0]
mov eax, 0x65c9e4
call fcn.00648f98
mov eax, dword [ebp - 0x12d0]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaec
pop edx
pop ecx
call fcn.006519e4
jmp 0x659689
mov byte [0x6858ec], 1
jmp 0x659689
push 0
lea eax, [ebp - 0x12d4]
push eax
mov ecx, 0x65ca20
mov edx, 0x65ca48
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x12d4]
lea edx, [ebp - 8]
call fcn.00648f98
cmp dword [ebp - 8], 0
je 0x659682
lea edx, [ebp - 0x12d8]
mov eax, dword [ebp - 8]
call fcn.00656850
cmp dword [ebp - 0x12d8], 0
je 0x659682
lea edx, [ebp - 0x12dc]
mov eax, 0x65ca60
call fcn.00648f98
mov eax, dword [ebp - 0x12dc]
mov dl, 1
call fcn.004241f0
test al, al
je 0x659682
push 1
push 1
push 0
push 0x65caa8
push dword [ebp - 8]
push 0x65cac0
lea edx, [ebp - 0x12e8]
mov eax, dword [ebp - 8]
call fcn.00656850
push dword [ebp - 0x12e8]
push 0x65caf8
lea eax, [ebp - 0x12e4]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0x12e4]
lea edx, [ebp - 0x12e0]
call fcn.00648f98
mov eax, dword [ebp - 0x12e0]
push eax
lea edx, [ebp - 0x12ec]
mov eax, 0x65cb08
call fcn.00648f98
mov eax, dword [ebp - 0x12ec]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaec
pop edx
pop ecx
call fcn.006519e4
test al, al
je 0x659679
mov eax, dword [0x68590c]
mov edx, 0x65cb50
call fcn.0040a4c8
je 0x659670
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
movzx eax, word [ebp - 0x76]
push eax
push 1
push 0
push 0x65cb60
lea edx, [ebp - 0x12f8]
mov eax, dword [ebp - 8]
call fcn.00656850
push dword [ebp - 0x12f8]
push 0x65cb94
push dword [ebp - 0xc]
lea eax, [ebp - 0x12f4]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x12f4]
lea edx, [ebp - 0x12f0]
call fcn.00648f98
mov eax, dword [ebp - 0x12f0]
push eax
lea edx, [ebp - 0x12fc]
mov eax, 0x65cba8
call fcn.00648f98
mov eax, dword [ebp - 0x12fc]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054aaec
pop edx
pop ecx
call fcn.006519e4
test al, al
jne 0x659689
mov byte [0x6858ec], 1
jmp 0x659689
mov byte [0x6858ec], 1
jmp 0x659689
mov byte [0x6858ec], 1
jmp 0x659689
mov byte [0x6858ec], 1
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d4]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x65977b
push 0x65cbe4
lea eax, [ebp - 0x1300]
push eax
mov ecx, 0x65cc24
mov edx, 0x65cc34
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1300]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov ecx, dword [ebp - 4]
mov edx, 0x65cc50
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65975f
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1304]
push eax
lea ecx, [ebp - 0x1308]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1308]
mov edx, 0x65cc74
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1304]
mov eax, dword [ebp - 0x58]
call fcn.0064f8fc
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x65971a
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x65cc98
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659867
push 0x65ccb8
lea eax, [ebp - 0x130c]
push eax
mov ecx, 0x65cd00
mov edx, 0x65cd10
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x130c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659867
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x6858ed], 0
jne 0x659867
push 0
lea eax, [ebp - 0x1310]
push eax
lea ecx, [ebp - 0x1314]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [ebp - 0x60]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1314]
mov edx, 0x65cd2c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1310]
mov eax, dword [ebp - 0x58]
call fcn.0064e014
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x65980d
push 0x65cd4c
lea eax, [ebp - 0x1318]
push eax
mov ecx, 0x65cd80
mov edx, 0x65cd94
mov eax, dword [0x6858dc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1318]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3b4]
call fcn.0054191c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov eax, 0x685928
call fcn.0040956c
mov ecx, dword [ebp - 4]
mov edx, 0x65cdb0
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659920
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x131c]
push eax
lea ecx, [ebp - 0x1320]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1320]
mov edx, 0x65cdc4
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x131c]
mov eax, dword [ebp - 0x58]
call fcn.0064f0c8
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6598db
push 0
mov ecx, 0x65cdd8
mov edx, 0x65ce04
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65997e
push 0xffffffffffffffff
mov ecx, 0x65ce1c
mov edx, 0x65ce48
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x65997e
cmp byte [0x6858eb], 0
je 0x659971
mov edx, 0x65ce60
mov eax, dword [ebp - 0x58]
call fcn.0064e014
jmp 0x65997e
mov edx, 0x65cf6c
mov eax, dword [ebp - 0x58]
call fcn.0064e014
mov eax, dword [0x67f754]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x6599fe
cmp byte [0x6858eb], 0
je 0x6599d0
push 0x65d078
push dword [0x685908]
push 0x65d114
lea eax, [ebp - 0x1324]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1324]
mov eax, dword [ebp - 0x58]
call fcn.0064e014
jmp 0x6599fe
push 0x65d148
push dword [0x685908]
push 0x65d1e4
lea eax, [ebp - 0x1328]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1328]
mov eax, dword [ebp - 0x58]
call fcn.0064e014
mov ecx, dword [ebp - 4]
mov edx, 0x65d218
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659a6d
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x132c]
push eax
lea ecx, [ebp - 0x1330]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1330]
mov edx, 0x65d240
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x132c]
mov eax, dword [ebp - 0x58]
call fcn.006505c4
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x659a28
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659ab9
xor eax, eax
push ebp
push 0x659aaf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x74]
push eax
push 0x1388
push 2
push 0x65d25c
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659ab9
mov ecx, dword [ebp - 4]
mov edx, 0x65d280
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659b28
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1334]
push eax
lea ecx, [ebp - 0x1338]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1338]
mov edx, 0x65d29c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1334]
mov eax, dword [ebp - 0x58]
call fcn.00652fc0
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x659ae3
mov ecx, dword [ebp - 4]
mov edx, 0x65d2b8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659be4
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x1340]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1340]
mov edx, 0x65d2d8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x133c]
mov dx, 4
mov eax, dword [ebp - 0x58]
call fcn.006538b8
push 0
lea eax, [ebp - 0x1344]
push eax
lea ecx, [ebp - 0x1348]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1348]
mov edx, 0x65d2f8
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x1344]
mov dx, 5
mov eax, dword [ebp - 0x58]
call fcn.006538b8
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x659b56
cmp byte [0x6858e4], 0
je 0x659c1b
xor eax, eax
push ebp
push 0x659c11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x685978]
push eax
call dword [0x685974]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659c1b
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3e8]
mov edx, 0x64
call fcn.0057650c
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
push 0x1f4
call sub.kernel32.dll_Sleep_2
cmp byte [0x6858e5], 0
je 0x659c6c
push 0
mov ecx, 0x65d318
mov edx, 0x65d340
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x659c6c
call fcn.006556dc
push 0
mov ecx, 0x65d358
mov edx, 0x65d388
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x659ca4
push 0
mov ecx, 0x65d3a0
mov edx, 0x65d3d4
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x659d50
lea edx, [ebp - 0x134c]
mov eax, 0x65d3ec
call fcn.00648f98
mov eax, dword [ebp - 0x134c]
mov dl, 1
call fcn.004241f0
test al, al
je 0x659d50
xor eax, eax
push ebp
push 0x659d46
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x1350]
mov eax, 0x65d434
call fcn.00648f98
mov eax, dword [ebp - 0x1350]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1354]
mov ecx, 0x65d478
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x1354]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1358]
mov eax, 0x65d4a4
call fcn.00648f98
mov edx, dword [ebp - 0x1358]
mov eax, 0x65d4e8
call fcn.0064b410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659d50
xor eax, eax
push ebp
push 0x659d7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x685954]
call fcn.004078f0
mov eax, dword [ebp - 4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659d84
cmp byte [0x68594f], 0
je 0x659db1
mov eax, dword [0x68592c]
call fcn.006568e8
test al, al
jne 0x659db1
push 0
mov ecx, 0x65d500
mov edx, 0x65d52c
mov eax, dword [0x6858e0]
mov ebx, dword [eax]
call dword [ebx + 0x18]
xor eax, eax
push ebp
push 0x659ddd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6858e0]
mov edx, dword [eax]
call dword [edx + 0x60]
mov eax, dword [0x6858e0]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659de7
cmp byte [0x6858e5], 0
je 0x659f49
cmp byte [0x68594a], 0
jne 0x659edf
push 0
push dword [0x68592c]
push 0x65d548
push dword [0x685924]
lea eax, [ebp - 0x135c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x135c]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1360]
mov ecx, 0x65d558
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x1360]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x659ed8
push 0
push dword [0x68592c]
push 0x65d584
movzx eax, byte [0x65c734]
push eax
lea eax, [ebp - 0x1368]
push eax
mov ecx, 0x65d594
mov edx, 0x65d5ac
mov eax, dword [0x685924]
call fcn.0042b81c
push dword [ebp - 0x1368]
lea eax, [ebp - 0x1364]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1364]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x136c]
mov ecx, 0x65d5c4
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x136c]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x659edf
mov byte [0x6858ec], 1
cmp byte [0x68594a], 0
je 0x659f49
push 0
push dword [0x68592c]
push 0x65d5f0
push dword [0x685940]
lea eax, [ebp - 0x1370]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1370]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1374]
mov ecx, 0x65d600
mov edx, dword [0x685904]
call fcn.0040a390
mov eax, dword [ebp - 0x1374]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x659f49
mov byte [0x6858ec], 1
push 0
mov ecx, 0x65d62c
mov edx, 0x65d658
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x659fd7
push 0xffffffffffffffff
mov ecx, 0x65d670
mov edx, 0x65d69c
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x659fd7
push 5
push 0
push 1
lea edx, [ebp - 0x137c]
mov eax, dword [ebp - 0x60]
call fcn.004235b4
mov ecx, dword [ebp - 0x137c]
lea eax, [ebp - 0x1378]
mov edx, 0x65d6b4
call fcn.0040a390
mov eax, dword [ebp - 0x1378]
push eax
lea eax, [ebp - 0x1380]
mov ecx, 0x65d6e0
mov edx, dword [0x68592c]
call fcn.0040a390
mov edx, dword [ebp - 0x1380]
xor eax, eax
pop ecx
call fcn.006519e4
mov eax, dword [0x67f50c]
mov eax, dword [eax]
call fcn.00612374
mov byte [0x68594c], 1
mov byte [0x6858ee], 0
push 0x3e8
call sub.kernel32.dll_Sleep_2
push 0
mov ecx, 0x65d708
mov edx, 0x65d720
mov eax, dword [0x6858d8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x65a01c
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65a08a
lea eax, [ebp - 0x1380]
mov edx, 0x60
call fcn.004095cc
lea eax, [ebp - 0x11f8]
mov edx, 4
call fcn.004095cc
lea eax, [ebp - 0x11e8]
mov edx, 0x56
call fcn.004095cc
lea eax, [ebp - 0x52]
mov edx, dword [0x61d498]
call fcn.0040aa44
lea eax, [ebp - 0x1c]
mov edx, dword [0x656c94]
call fcn.0040aa44
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004095cc
ret