Function at 0x655014
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x65501d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
call fcn.0040b558
lea eax, [ebp - 0x20]
mov edx, dword [0x654f70]
call fcn.0040c7ac
mov ebx, 0x68a28c
xor eax, eax
push ebp
push 0x656927
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x656855
cmp byte [0x68a206], 0
je 0x655080
mov eax, 0x656944
call fcn.00644e7c
test al, al
jne 0x656855
cmp byte [0x68a275], 0
je 0x65509b
mov eax, 0x656970
call fcn.00644e7c
test al, al
jne 0x656855
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0xc4]
push eax
mov ecx, 0x6569a0
mov edx, 0x6569b4
mov eax, dword [ebp - 4]
call fcn.0043167c
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 7
jl 0x656855
lea ecx, [ebp - 0xc8]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc8]
mov ecx, 1
mov edx, eax
mov eax, 0x6569c8
call fcn.0040c52c
test eax, eax
jle 0x655113
cmp byte [0x68a210], 0
jne 0x656855
lea ecx, [ebp - 0xcc]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xcc]
mov ecx, 1
mov edx, eax
mov eax, 0x6569dc
call fcn.0040c52c
test eax, eax
jle 0x65514d
cmp byte [0x68a210], 0
je 0x656855
lea ecx, [ebp - 0xd4]
mov edx, 3
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.00427060
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x18]
call fcn.0040b89c
mov eax, esi
dec ax
je 0x655196
dec ax
je 0x6551ab
dec ax
je 0x6551c0
dec ax
je 0x6551d5
jmp 0x6551e8
mov eax, dword [ebp - 0x18]
mov edx, 0x6569f0
call fcn.0040c398
jne 0x656855
jmp 0x6551e8
mov eax, dword [ebp - 0x18]
mov edx, 0x656a24
call fcn.0040c398
jne 0x656855
jmp 0x6551e8
mov eax, dword [ebp - 0x18]
mov edx, 0x656a68
call fcn.0040c398
jne 0x656855
jmp 0x6551e8
mov eax, dword [ebp - 0x18]
mov edx, 0x656aa4
call fcn.0040c398
jne 0x656855
push 0
mov ecx, 0x656ad8
mov edx, 0x656af8
mov eax, dword [0x68a1f8]
mov edi, dword [eax]
call dword [edi + 0x20]
test al, al
je 0x655266
lea ecx, [ebp - 0xdc]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xd8]
call fcn.0064597c
mov ecx, dword [ebp - 0xd8]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x20]
lea ecx, [ebp - 0xe4]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.0064597c
mov ecx, dword [ebp - 0xe0]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, 0x656b10
call fcn.00644e7c
test al, al
je 0x6552d8
lea ecx, [ebp - 0xec]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00648370
mov edx, dword [ebp - 0xe8]
lea eax, [ebp - 0x20]
call fcn.0040b89c
lea ecx, [ebp - 0xf4]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00648370
mov edx, dword [ebp - 0xf0]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
jmp 0x6554fb
cmp si, 5
jne 0x655325
lea ecx, [ebp - 0xfc]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.00427060
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x34], eax
mov ecx, 1
mov edx, dword [ebp - 0x34]
mov eax, 0x656b34
call fcn.0040c52c
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
setg al
jmp 0x655327
xor eax, eax
test al, al
je 0x6553b7
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x656b4c]
push eax
lea eax, [ebp - 0x100]
push eax
mov ecx, 0x656b5c
mov edx, 0x656b78
mov eax, dword [ebp - 8]
call fcn.0043167c
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 8]
call fcn.0040b89c
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 8]
call fcn.00648370
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 8]
call fcn.0040b89c
movzx eax, byte [0x656b4c]
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x656b78
mov edx, 0x656b5c
mov eax, dword [ebp - 8]
call fcn.0043167c
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x20]
call fcn.0040b89c
jmp 0x6553e5
lea ecx, [ebp - 0x110]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00648370
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x20]
call fcn.0040b89c
cmp si, 5
jne 0x655435
lea ecx, [ebp - 0x118]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.00427060
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x3c], eax
mov ecx, 1
mov edx, dword [ebp - 0x3c]
mov eax, 0x656b34
call fcn.0040c52c
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
setg al
jmp 0x655437
xor eax, eax
test al, al
je 0x6554ca
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x656b4c]
push eax
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x656b5c
mov edx, 0x656b78
mov eax, dword [ebp - 8]
call fcn.0043167c
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 8]
call fcn.0040b89c
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 8]
call fcn.00648370
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 8]
call fcn.0040b89c
movzx eax, byte [0x656b4c]
push eax
lea eax, [ebp - 0x124]
push eax
mov ecx, 0x656b78
mov edx, 0x656b5c
mov eax, dword [ebp - 8]
call fcn.0043167c
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
jmp 0x6554fb
lea ecx, [ebp - 0x12c]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.00648370
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
cmp si, 5
jne 0x6556c9
mov eax, dword [ebp - 0x18]
mov edx, 0x656b9c
call fcn.0040c398
jne 0x65559a
push dword [ebp - 0x20]
push 0x6569b4
push dword [ebp - 0x1c]
push 0x6569b4
lea ecx, [ebp - 0x134]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x134]
push 0x6569b4
lea ecx, [ebp - 0x138]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x138]
push 0x6569b4
lea ecx, [ebp - 0x13c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x13c]
lea eax, [ebp - 0x130]
mov edx, 9
call fcn.0040c2e8
mov edx, dword [ebp - 0x130]
mov eax, 0x656bd4
call fcn.0064ab38
mov eax, dword [ebp - 0x18]
mov edx, 0x656c0c
call fcn.0040c398
jne 0x65562f
push dword [ebp - 0x20]
push 0x6569b4
push dword [ebp - 0x1c]
push 0x6569b4
lea ecx, [ebp - 0x144]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x144]
push 0x6569b4
lea ecx, [ebp - 0x148]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x148]
push 0x6569b4
lea ecx, [ebp - 0x14c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x14c]
lea eax, [ebp - 0x140]
mov edx, 9
call fcn.0040c2e8
mov edx, dword [ebp - 0x140]
mov eax, 0x656c44
call fcn.0064ab38
mov eax, dword [ebp - 0x18]
mov edx, 0x656c78
call fcn.0040c398
jne 0x656855
push dword [ebp - 0x20]
push 0x6569b4
push dword [ebp - 0x1c]
push 0x6569b4
lea ecx, [ebp - 0x154]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x154]
push 0x6569b4
lea ecx, [ebp - 0x158]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x158]
push 0x6569b4
lea ecx, [ebp - 0x15c]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x15c]
lea eax, [ebp - 0x150]
mov edx, 9
call fcn.0040c2e8
mov edx, dword [ebp - 0x150]
mov eax, 0x656cb0
call fcn.0064ab38
jmp 0x656855
lea ecx, [ebp - 0x164]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00427060
mov ecx, dword [ebp - 0x160]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0x168]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x168]
mov edx, 0x656ce4
call fcn.0040c398
jne 0x65572d
mov word [ebp - 0x14], 1
jmp 0x6557b7
lea ecx, [ebp - 0x16c]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x16c]
mov edx, 0x656d00
call fcn.0040c398
jne 0x655759
mov word [ebp - 0x14], 3
jmp 0x6557b7
lea ecx, [ebp - 0x170]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x170]
mov edx, 0x656d20
call fcn.0040c398
jne 0x655785
mov word [ebp - 0x14], 2
jmp 0x6557b7
lea ecx, [ebp - 0x174]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x174]
mov edx, 0x656d40
call fcn.0040c398
jne 0x6557b1
mov word [ebp - 0x14], 0
jmp 0x6557b7
mov word [ebp - 0x14], 1
lea ecx, [ebp - 0x17c]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.00427060
mov ecx, dword [ebp - 0x178]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0x180]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x180]
mov edx, 0x656d58
call fcn.0040c398
je 0x655838
lea ecx, [ebp - 0x184]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x184]
mov edx, 0x656d6c
call fcn.0040c398
je 0x655838
xor eax, eax
jmp 0x65583a
mov al, 1
mov byte [ebp - 0x12], al
lea ecx, [ebp - 0x18c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
call fcn.00427060
mov ecx, dword [ebp - 0x188]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0x190]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x190]
mov edx, 0x656d58
call fcn.0040c398
je 0x6558be
lea ecx, [ebp - 0x194]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x194]
mov edx, 0x656d6c
call fcn.0040c398
je 0x6558be
xor eax, eax
jmp 0x6558c0
mov al, 1
mov byte [ebp - 0x11], al
mov byte [0x68a278], 0
mov byte [0x68a279], 0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6558dd
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x655e58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x6558f8
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x655e58
lea eax, [ebp - 0x19c]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040c3d0
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.00427060
mov eax, dword [ebp - 0x198]
mov edx, 0x656d7c
call fcn.0040c398
jne 0x655e58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov ecx, 1
mov edx, dword [ebp - 0x48]
mov eax, 0x656d90
call fcn.0040c52c
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jle 0x655e58
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x656da0
call fcn.0040c52c
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jle 0x655e58
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x65599c
mov eax, dword [ebp - 0x54]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 0x20]
call fcn.0040c3d0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x656da0
call fcn.0040c52c
mov dword [ebp - 0x58], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x58]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x656da0
call fcn.0040c52c
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x655a09
mov eax, dword [ebp - 0x60]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x5c]
inc edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x20]
call fcn.0040c3d0
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 8]
call fcn.00648370
mov edx, dword [ebp - 0x1a0]
lea eax, [ebp - 8]
call fcn.0040b89c
lea edx, [ebp - 0x1a4]
mov eax, dword [ebp - 0xc]
call fcn.00648370
mov edx, dword [ebp - 0x1a4]
lea eax, [ebp - 0xc]
call fcn.0040b89c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040c398
jne 0x656855
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b89c
lea eax, [ebp - 0x1ac]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1ac]
lea edx, [ebp - 0x1a8]
call fcn.00427060
mov eax, dword [ebp - 0x1a8]
mov edx, 0x656db0
call fcn.0040c398
je 0x655b68
lea eax, [ebp - 0x1b4]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.00427060
mov eax, dword [ebp - 0x1b0]
mov edx, 0x656dc8
call fcn.0040c398
je 0x655b68
lea eax, [ebp - 0x1bc]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.00427060
mov eax, dword [ebp - 0x1b8]
mov edx, 0x656de0
call fcn.0040c398
je 0x655b68
lea eax, [ebp - 0x1c4]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1c0]
call fcn.00427060
mov eax, dword [ebp - 0x1c0]
mov edx, 0x656df8
call fcn.0040c398
jne 0x656855
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x656d90
call fcn.0040c52c
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x64]
mov edx, 1
call fcn.0040c418
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x656e14
call fcn.0040c52c
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jle 0x655bd2
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x656e14
call fcn.0040c52c
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x6c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040c3d0
lea edx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x10]
call fcn.00648370
mov edx, dword [ebp - 0x1c8]
lea eax, [ebp - 0x10]
call fcn.0040b89c
lea eax, [ebp - 0x1d0]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x1d0]
lea edx, [ebp - 0x1cc]
call fcn.00427060
mov eax, dword [ebp - 0x1cc]
mov edx, 0x656e24
call fcn.0040c398
jne 0x655c63
cmp byte [0x68a206], 0
jne 0x655c63
push 0x40040
lea edx, [ebp - 0x1d4]
mov eax, dword [0x68a1c4]
call fcn.00551394
mov eax, dword [ebp - 0x1d4]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x24]
call fcn.0055aff4
push eax
call sub.user32.dll_MessageBoxW
lea eax, [ebp - 0x1dc]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.00427060
mov eax, dword [ebp - 0x1d8]
mov edx, 0x656e34
call fcn.0040c398
jne 0x655d4b
cmp byte [0x68a206], 0
jne 0x655d4b
push 0x40024
lea edx, [ebp - 0x1e0]
mov eax, dword [0x68a1c4]
call fcn.00551394
mov eax, dword [ebp - 0x1e0]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x24]
call fcn.0055aff4
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x655d4b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x70], eax
mov ecx, 1
mov edx, dword [ebp - 0x70]
mov eax, 0x656e14
call fcn.0040c52c
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x655d1d
mov eax, dword [ebp - 0x7c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
push 0
movzx eax, byte [ebp - 0x11]
push eax
lea eax, [ebp - 0x1e4]
push eax
mov edx, dword [ebp - 0x74]
inc edx
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov edx, dword [ebp - 0x1e4]
movzx ecx, byte [ebp - 0x12]
xor eax, eax
call fcn.006534bc
lea eax, [ebp - 0x1ec]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x1ec]
lea edx, [ebp - 0x1e8]
call fcn.00427060
mov eax, dword [ebp - 0x1e8]
mov edx, 0x656e44
call fcn.0040c398
jne 0x655dcd
cmp dword [ebp - 0x10], 0
je 0x655dc6
cmp byte [0x68a206], 0
jne 0x655dc6
push 0x40030
lea edx, [ebp - 0x1f0]
mov eax, dword [0x68a1c4]
call fcn.00551394
mov eax, dword [ebp - 0x1f0]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x24]
call fcn.0055aff4
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68a278], 1
lea eax, [ebp - 0x1f8]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.00427060
mov eax, dword [ebp - 0x1f4]
mov edx, 0x656e54
call fcn.0040c398
jne 0x656855
cmp dword [ebp - 0x10], 0
je 0x655e4c
cmp byte [0x68a206], 0
jne 0x655e4c
push 0x40030
lea edx, [ebp - 0x1fc]
mov eax, dword [0x68a1c4]
call fcn.00551394
mov eax, dword [ebp - 0x1fc]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x24]
call fcn.0055aff4
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68a279], 1
jmp 0x656855
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x655e64
sub eax, 4
mov eax, dword [eax]
cmp eax, 7
jle 0x655fae
lea eax, [ebp - 0x200]
push eax
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 0x20]
call fcn.00427060
mov eax, dword [ebp - 0x204]
mov ecx, 6
mov edx, 1
call fcn.0040c3d0
mov eax, dword [ebp - 0x200]
mov edx, 0x656df8
call fcn.0040c398
jne 0x655fae
cmp dword [ebp - 0x1c], 0
je 0x655fae
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.0040b89c
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.0040c418
mov eax, dword [ebp - 8]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x655eeb
mov eax, dword [ebp - 0x80]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x80]
cmp word [eax + edx*2 - 2], 0x29
jne 0x655f2f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x655f1c
mov eax, dword [ebp - 0x84]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [ebp - 0x84]
call fcn.0040c418
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 8]
call fcn.00648370
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 8]
call fcn.0040b89c
push 0x40024
lea edx, [ebp - 0x20c]
mov eax, dword [0x68a1c4]
call fcn.00551394
mov eax, dword [ebp - 0x20c]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 8]
call fcn.0040bffc
push eax
mov eax, dword [ebp - 0x24]
call fcn.0055aff4
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x656855
push 0
movzx eax, byte [ebp - 0x11]
push eax
mov eax, dword [0x68a1c4]
call fcn.0055aff4
movzx ecx, byte [ebp - 0x12]
mov edx, dword [ebp - 0x1c]
call fcn.006534bc
jmp 0x656855
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x655fba
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xc
jle 0x656000
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 0x20]
call fcn.00427060
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x88], eax
mov ecx, 1
mov edx, dword [ebp - 0x88]
mov eax, 0x656e64
call fcn.0040c52c
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
sete al
jmp 0x656002
xor eax, eax
test al, al
je 0x65610f
cmp dword [ebp - 0x1c], 0
je 0x65610f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x90], eax
mov ecx, 1
mov edx, dword [ebp - 0x90]
mov eax, 0x656e84
call fcn.0040c52c
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jle 0x65606d
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0x214]
push eax
xor ecx, ecx
mov edx, 0x656e84
mov eax, dword [ebp - 0x1c]
call fcn.0043167c
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x656e94
call fcn.0040c52c
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x6560a8
mov eax, dword [ebp - 0x9c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x218]
push eax
mov edx, dword [ebp - 0x98]
inc edx
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x20]
call fcn.0040c3d0
mov eax, dword [ebp - 0x218]
mov cl, 1
mov edx, dword [ebp - 0x1c]
call fcn.006454c0
test al, al
jne 0x656855
mov eax, 0x656ea4
call fcn.00644e7c
test al, al
je 0x6560f1
mov byte [0x68a20d], 1
mov eax, 0x656ed0
call fcn.00644e7c
test al, al
je 0x656855
mov byte [0x68a278], 1
jmp 0x656855
mov edx, 0x656efc
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x65629e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], eax
mov ecx, 1
mov edx, dword [ebp - 0xa0]
mov eax, 0x656e84
call fcn.0040c52c
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jle 0x656182
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0x21c]
push eax
xor ecx, ecx
mov edx, 0x656e84
mov eax, dword [ebp - 0x1c]
call fcn.0043167c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
lea edx, [ebp - 0x220]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x220]
mov dl, 1
call fcn.00428a24
test al, al
je 0x656855
mov byte [ebp - 0x2d], 0
mov dl, 1
mov eax, dword [0x487c78]
call fcn.004b3e5c
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x65624a
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x228]
mov edx, ebx
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x228]
mov ecx, 1
mov edx, eax
mov eax, 0x656f18
call fcn.0040c52c
test eax, eax
jle 0x656246
mov byte [ebp - 0x2d], 1
lea ecx, [ebp - 0x230]
mov edx, ebx
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x22c]
call fcn.00648370
mov ecx, dword [ebp - 0x22c]
mov edx, ebx
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x6561e6
cmp byte [ebp - 0x2d], 0
je 0x656291
xor eax, eax
push ebp
push 0x656287
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656291
mov eax, dword [ebp - 0x2c]
call fcn.00409674
jmp 0x656855
mov edx, 0x656f28
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656378
mov edx, 0x656f50
mov eax, dword [0x68a1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x656378
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x418]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x656f50
mov eax, dword [0x68a1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a1c4]
mov eax, dword [eax + 0x418]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [0x68a284]
mov edx, dword [eax]
call dword [edx + 0x48]
mov esi, dword [ebp - 0x28]
dec esi
test esi, esi
jl 0x656357
inc esi
xor ebx, ebx
push 0
lea eax, [ebp - 0x238]
push eax
lea edx, [ebp - 0x23c]
mov eax, ebx
call fcn.00427d80
mov ecx, dword [ebp - 0x23c]
mov edx, 0x656f50
mov eax, dword [0x68a1f8]
mov edi, dword [eax]
call dword [edi + 8]
mov eax, dword [ebp - 0x238]
call fcn.0064afc8
inc ebx
dec esi
jne 0x65631d
call fcn.00653b3c
mov eax, 0x656f70
call fcn.00644e7c
test al, al
jne 0x656855
call fcn.00654c7c
jmp 0x656855
mov edx, 0x656fa4
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656440
cmp dword [ebp - 0x1c], 0
jne 0x6563a6
lea eax, [ebp - 0x1c]
mov edx, dword [0x68a25c]
call fcn.0040b89c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xa8], eax
mov ecx, 1
mov edx, dword [ebp - 0xa8]
mov eax, 0x656e84
call fcn.0040c52c
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jle 0x6563ff
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0x240]
push eax
xor ecx, ecx
mov edx, 0x656e84
mov eax, dword [ebp - 0x1c]
call fcn.0043167c
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x244]
mov dl, 1
call fcn.00428abc
test al, al
je 0x656855
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x248]
call fcn.004295c8
jmp 0x656855
mov edx, 0x656fcc
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x65646e
cmp dword [ebp - 0x1c], 0
je 0x65646e
mov edx, dword [ebp - 0x1c]
mov eax, 0x656ff4
call fcn.0064ab38
jmp 0x656855
mov edx, 0x65700c
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x6564fd
cmp byte [0x68a210], 0
je 0x6564fd
xor eax, eax
push ebp
push 0x6564ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x68a2ac], eax
push 0x657020
push 0x657060
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2a4], eax
push 0x65707c
push 0x657060
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2a8], eax
push 0x68a2ac
call dword [0x68a2a4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656855
mov edx, 0x6570c4
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656552
cmp byte [0x68a210], 0
je 0x656552
xor eax, eax
push ebp
push 0x656543
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a2ac]
push eax
call dword [0x68a2a8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656855
mov edx, 0x6570e0
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x65657d
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
jmp 0x656855
mov edx, 0x657114
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x6565a5
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
jmp 0x656855
mov edx, 0x65714c
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656677
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb0], eax
mov ecx, 1
mov edx, dword [ebp - 0xb0]
mov eax, 0x656e84
call fcn.0040c52c
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jle 0x656618
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0x24c]
push eax
xor ecx, ecx
mov edx, 0x656e84
mov eax, dword [ebp - 0x1c]
call fcn.0043167c
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x250]
mov dl, 1
call fcn.00428a24
test al, al
je 0x656855
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x254]
call fcn.0040bffc
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x656855
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x656855
mov edx, 0x657168
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656749
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb8], eax
mov ecx, 1
mov edx, dword [ebp - 0xb8]
mov eax, 0x656e84
call fcn.0040c52c
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jle 0x6566ea
movzx eax, byte [0x656990]
push eax
lea eax, [ebp - 0x258]
push eax
xor ecx, ecx
mov edx, 0x656e84
mov eax, dword [ebp - 0x1c]
call fcn.0043167c
mov edx, dword [ebp - 0x258]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
lea edx, [ebp - 0x25c]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x25c]
mov dl, 1
call fcn.00428a24
test al, al
je 0x656855
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 0x1c]
call fcn.00644f84
mov eax, dword [ebp - 0x260]
call fcn.0040bffc
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x656855
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x656855
mov edx, 0x657188
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x656774
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x656855
mov edx, 0x6571b0
mov eax, dword [ebp - 0x20]
call fcn.00427200
test eax, eax
sete al
test al, al
je 0x6567d0
xor eax, eax
push ebp
push 0x6567c1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1388
push 2
push 0x6571d4
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656855
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x6571f8
call fcn.0040c52c
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x65682e
lea edx, [ebp - 0x264]
mov eax, dword [ebp - 0x20]
call fcn.00644f84
mov eax, dword [ebp - 0x264]
mov dl, 1
call fcn.00428a24
test al, al
je 0x65682e
movzx eax, word [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.00651ed4
jmp 0x656849
movzx eax, word [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040bffc
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x6823c8]
mov eax, dword [eax]
call fcn.0060c280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656931
lea eax, [ebp - 0x264]
mov edx, 0x16
call fcn.0040b4c4
lea eax, [ebp - 0x20c]
call fcn.0040b464
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x1fc]
call fcn.0040b464
lea eax, [ebp - 0x1f8]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1f0]
call fcn.0040b464
lea eax, [ebp - 0x1ec]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x1e0]
call fcn.0040b464
lea eax, [ebp - 0x1dc]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1d4]
call fcn.0040b464
lea eax, [ebp - 0x1d0]
mov edx, 0x3f
call fcn.0040b4c4
lea eax, [ebp - 0xd4]
mov edx, 5
call fcn.0040b4c4
lea eax, [ebp - 0x20]
mov edx, dword [0x654f70]
call fcn.0040cb78
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040b4c4
pop eax
jmp eax