Function at 0x654afc
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x277
push 0
push 0
dec ecx
jne 0x654b04
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x654970]
call fcn.0040a96c
lea eax, [ebp - 0x52]
mov edx, dword [0x621068]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x658061
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48fec4]
call fcn.004b3874
mov dword [0x686954], eax
mov byte [0x686901], 0
mov byte [0x686900], 0
lea edx, [ebp - 0x109c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
mov eax, dword [ebp - 0x109c]
lea edx, [ebp - 0x1098]
call fcn.00422c38
mov eax, dword [ebp - 0x1098]
lea edx, [ebp - 0x1094]
call fcn.0042b5f4
mov edx, dword [ebp - 0x1094]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0054198c
push 0
lea eax, [ebp - 0x10a4]
push eax
mov ecx, 0x658080
mov edx, 0x6580ac
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10a4]
lea edx, [ebp - 0x10a0]
call fcn.00646cac
mov edx, dword [ebp - 0x10a0]
mov eax, 0x686920
call fcn.0040994c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x434]
xor edx, edx
call fcn.00577364
push 0x6580c4
lea eax, [ebp - 0x10a8]
push eax
mov ecx, 0x6580ec
mov edx, 0x658100
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x10a8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
push 0
mov ecx, 0x65811c
mov edx, 0x658144
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov byte [0x686904], al
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
xor eax, eax
mov dword [0x686968], eax
xor eax, eax
mov dword [0x68696c], eax
xor eax, eax
mov dword [0x686970], eax
xor eax, eax
mov dword [0x686974], eax
xor eax, eax
mov dword [0x686978], eax
cmp byte [0x686905], 0
je 0x654e2d
lea edx, [ebp - 0x10b0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x10b0]
push 0x65815c
push dword [0x686948]
lea eax, [ebp - 0x10ac]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10ac]
mov dl, 1
call fcn.004241f8
test al, al
je 0x654e2d
push 0
lea eax, [ebp - 0x10b4]
mov ecx, 0x65816c
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x10b4]
call fcn.0040a13c
push eax
lea edx, [ebp - 0x10bc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x10bc]
push 0x658198
push dword [0x686948]
lea eax, [ebp - 0x10b8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10b8]
call fcn.0040a13c
push eax
call sub.KERNEL32.DLL_CopyFileW
test eax, eax
je 0x654e60
lea eax, [ebp - 0x10c0]
mov ecx, 0x6581a8
mov edx, dword [0x686918]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c0]
mov dl, 1
mov eax, dword [0x507798]
call fcn.0050a944
mov dword [0x6868f4], eax
mov ecx, dword [0x686954]
mov edx, 0x6581d4
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x686954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x686968], eax
mov ecx, dword [0x686954]
mov edx, 0x6581ec
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x686954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x68696c], eax
mov ecx, dword [0x686954]
mov edx, 0x658208
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x686954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x686970], eax
mov ecx, dword [0x686954]
mov edx, 0x658230
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x686954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x686974], eax
mov ecx, dword [0x686954]
mov edx, 0x65825c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x686954]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x686978], eax
jmp 0x654e60
call fcn.00430960
push eax
lea eax, [ebp - 0x10c4]
mov ecx, 0x65827c
mov edx, dword [0x686918]
call fcn.0040a390
mov ecx, dword [ebp - 0x10c4]
mov dl, 1
mov eax, dword [0x507798]
call fcn.0050a97c
mov dword [0x6868f4], eax
push 0
mov ecx, 0x6582a8
mov edx, 0x6582cc
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x654e97
push 0
mov ecx, 0x6582e4
mov edx, 0x65830c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
je 0x6557cc
lea edx, [ebp - 0x10c8]
mov al, 0x1c
call fcn.00644998
mov eax, dword [ebp - 0x10c8]
push eax
mov ecx, 0x658324
mov edx, 0x658340
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x10cc]
mov al, 0x1d
call fcn.00644998
mov eax, dword [ebp - 0x10cc]
push eax
mov ecx, 0x65835c
mov edx, 0x658380
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10d4]
push eax
mov ecx, 0x65839c
mov edx, 0x6583ac
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00646cac
mov eax, dword [ebp - 0x10d0]
push eax
mov ecx, 0x6583cc
mov edx, 0x6583dc
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
lea eax, [ebp - 8]
call fcn.0040956c
push 0
mov ecx, 0x6583fc
mov edx, 0x658418
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x654fbc
push 0
mov ecx, 0x658430
mov edx, 0x658448
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x654fbc
lea eax, [ebp - 8]
mov edx, 0x658460
call fcn.00409994
push 0
mov ecx, 0x65851c
mov edx, 0x658534
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x654fbc
cmp dword [0x6868c4], 0
jne 0x654faa
cmp dword [0x6868c0], 0xe4e1c0
jbe 0x654fbc
jmp 0x654fac
jle 0x654fbc
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4a8]
mov dl, 1
call fcn.00541854
push 0
lea eax, [ebp - 0x10e0]
push eax
mov ecx, 0x65854c
mov edx, 0x65855c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e0]
lea edx, [ebp - 0x10dc]
call fcn.00646cac
mov ecx, dword [ebp - 0x10dc]
lea eax, [ebp - 0x10d8]
mov edx, dword [ebp - 8]
call fcn.0040a390
mov eax, dword [ebp - 0x10d8]
push eax
mov ecx, 0x65857c
mov edx, 0x65858c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10e8]
push eax
mov ecx, 0x6585ac
mov edx, 0x6585bc
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e8]
lea edx, [ebp - 0x10e4]
call fcn.00646cac
mov eax, dword [ebp - 0x10e4]
push eax
mov ecx, 0x6585dc
mov edx, 0x6585ec
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f0]
push eax
mov ecx, 0x65860c
mov edx, 0x65861c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f0]
lea edx, [ebp - 0x10ec]
call fcn.00646cac
mov eax, dword [ebp - 0x10ec]
push eax
mov ecx, 0x65863c
mov edx, 0x65864c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f8]
push eax
mov ecx, 0x65866c
mov edx, 0x65867c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f8]
lea edx, [ebp - 0x10f4]
call fcn.00646cac
mov eax, dword [ebp - 0x10f4]
push eax
mov ecx, 0x65869c
mov edx, 0x6586ac
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1100]
push eax
mov ecx, 0x6586cc
mov edx, 0x6586dc
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1100]
lea edx, [ebp - 0x10fc]
call fcn.00646cac
mov eax, dword [ebp - 0x10fc]
push eax
mov ecx, 0x6586fc
mov edx, 0x65870c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1108]
push eax
mov ecx, 0x65872c
mov edx, 0x65873c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1108]
lea edx, [ebp - 0x1104]
call fcn.00646cac
mov eax, dword [ebp - 0x1104]
push eax
mov ecx, 0x65875c
mov edx, 0x65876c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1110]
push eax
mov ecx, 0x65878c
mov edx, 0x65879c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1110]
lea edx, [ebp - 0x110c]
call fcn.00646cac
mov eax, dword [ebp - 0x110c]
push eax
mov ecx, 0x6587bc
mov edx, 0x6587cc
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1118]
push eax
mov ecx, 0x6587ec
mov edx, 0x6587fc
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1118]
lea edx, [ebp - 0x1114]
call fcn.00646cac
mov eax, dword [ebp - 0x1114]
push eax
mov ecx, 0x65881c
mov edx, 0x65882c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1120]
push eax
mov ecx, 0x65884c
mov edx, 0x65885c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1120]
lea edx, [ebp - 0x111c]
call fcn.00646cac
mov eax, dword [ebp - 0x111c]
push eax
mov ecx, 0x65887c
mov edx, 0x65888c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1128]
push eax
mov ecx, 0x6588ac
mov edx, 0x6588bc
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1128]
lea edx, [ebp - 0x1124]
call fcn.00646cac
mov eax, dword [ebp - 0x1124]
push eax
mov ecx, 0x6588d8
mov edx, 0x6588e8
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1130]
push eax
mov ecx, 0x658904
mov edx, 0x658914
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1130]
lea edx, [ebp - 0x112c]
call fcn.00646cac
mov eax, dword [ebp - 0x112c]
push eax
mov ecx, 0x658930
mov edx, 0x658940
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1138]
push eax
mov ecx, 0x65895c
mov edx, 0x65896c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1138]
lea edx, [ebp - 0x1134]
call fcn.00646cac
mov eax, dword [ebp - 0x1134]
push eax
mov ecx, 0x658988
mov edx, 0x658998
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1140]
push eax
mov ecx, 0x6589b4
mov edx, 0x6589c4
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1140]
lea edx, [ebp - 0x113c]
call fcn.00646cac
mov eax, dword [ebp - 0x113c]
push eax
mov ecx, 0x6589e0
mov edx, 0x6589f0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1148]
push eax
mov ecx, 0x658a0c
mov edx, 0x658a1c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1148]
lea edx, [ebp - 0x1144]
call fcn.00646cac
mov eax, dword [ebp - 0x1144]
push eax
mov ecx, 0x658a38
mov edx, 0x658a48
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1150]
push eax
mov ecx, 0x658a64
mov edx, 0x658a74
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00646cac
mov eax, dword [ebp - 0x114c]
push eax
mov ecx, 0x658a90
mov edx, 0x658aa0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1158]
push eax
mov ecx, 0x658abc
mov edx, 0x658acc
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1158]
lea edx, [ebp - 0x1154]
call fcn.00646cac
mov eax, dword [ebp - 0x1154]
push eax
mov ecx, 0x658ae8
mov edx, 0x658af8
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1160]
push eax
mov ecx, 0x658b14
mov edx, 0x658b24
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1160]
lea edx, [ebp - 0x115c]
call fcn.00646cac
mov eax, dword [ebp - 0x115c]
push eax
mov ecx, 0x658b40
mov edx, 0x658b50
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1168]
push eax
mov ecx, 0x658b6c
mov edx, 0x658b7c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00646cac
mov eax, dword [ebp - 0x1164]
push eax
mov ecx, 0x658b98
mov edx, 0x658ba8
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x658bc4
mov edx, 0x658bd4
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.00646cac
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x658bf0
mov edx, 0x658c00
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x658c1c
mov edx, 0x658c30
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.00646cac
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x658c4c
mov edx, 0x658c60
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x658c7c
mov edx, 0x658c90
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.00646cac
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x658cac
mov edx, 0x658cc0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x658cdc
mov edx, 0x658cf0
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.00646cac
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x658d0c
mov edx, 0x658d20
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1190]
push eax
mov ecx, 0x658d3c
mov edx, 0x658d50
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1190]
lea edx, [ebp - 0x118c]
call fcn.00646cac
mov eax, dword [ebp - 0x118c]
push eax
mov ecx, 0x658d6c
mov edx, 0x658d80
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1198]
push eax
mov ecx, 0x658d9c
mov edx, 0x658db0
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1198]
lea edx, [ebp - 0x1194]
call fcn.00646cac
mov eax, dword [ebp - 0x1194]
push eax
mov ecx, 0x658dcc
mov edx, 0x658de0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11a0]
push eax
mov ecx, 0x658dfc
mov edx, 0x658e10
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11a0]
lea edx, [ebp - 0x119c]
call fcn.00646cac
mov eax, dword [ebp - 0x119c]
push eax
mov ecx, 0x658e2c
mov edx, 0x658e40
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11a8]
push eax
mov ecx, 0x658e5c
mov edx, 0x658e70
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11a8]
lea edx, [ebp - 0x11a4]
call fcn.00646cac
mov eax, dword [ebp - 0x11a4]
push eax
mov ecx, 0x658e8c
mov edx, 0x658ea0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11b0]
push eax
mov ecx, 0x658ebc
mov edx, 0x658ed0
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11b0]
lea edx, [ebp - 0x11ac]
call fcn.00646cac
mov eax, dword [ebp - 0x11ac]
push eax
mov ecx, 0x658eec
mov edx, 0x658f00
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11b8]
push eax
mov ecx, 0x658f1c
mov edx, 0x658f30
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11b8]
lea edx, [ebp - 0x11b4]
call fcn.00646cac
mov eax, dword [ebp - 0x11b4]
push eax
mov ecx, 0x658f4c
mov edx, 0x658f60
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x11bc]
mov al, 0x37
call fcn.00644998
mov eax, dword [ebp - 0x11bc]
push eax
mov ecx, 0x658f7c
mov edx, 0x658f94
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
movzx eax, byte [0x6868ff]
push eax
mov ecx, 0x658fb0
mov edx, 0x658fd4
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x6868fc]
push eax
mov ecx, 0x658ff0
mov edx, 0x659008
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x6868f8]
push eax
mov ecx, 0x659024
mov edx, 0x659038
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
lea edx, [ebp - 0x11c0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
mov eax, dword [ebp - 0x11c0]
push eax
mov ecx, 0x659054
mov edx, 0x659078
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [0x686920], 0
je 0x65589a
mov eax, dword [0x686920]
push eax
mov ecx, 0x659094
mov edx, 0x6590c0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x11c4]
mov al, 0x1a
call fcn.00644998
mov eax, dword [ebp - 0x11c4]
push eax
mov ecx, 0x6590dc
mov edx, 0x659108
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x6868f9], 0
je 0x655b21
push 0
mov ecx, 0x659124
mov edx, 0x659150
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659168
mov edx, 0x65918c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6591a8
mov edx, 0x6591d4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6591ec
mov edx, 0x659218
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x659234
mov edx, 0x659264
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65927c
mov edx, 0x6592ac
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6592c8
mov edx, 0x6592f8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x6559b5
push 0
lea eax, [ebp - 0x11cc]
push eax
mov ecx, 0x659310
mov edx, 0x659350
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11cc]
lea edx, [ebp - 0x11c8]
call fcn.00646cac
mov eax, dword [ebp - 0x11c8]
push eax
mov ecx, 0x659368
mov edx, 0x6593a8
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x6559cb
push 0
mov ecx, 0x6593c4
mov edx, 0x659404
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x659420
mov edx, 0x659454
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x655a30
push 0
lea eax, [ebp - 0x11d4]
push eax
mov ecx, 0x65946c
mov edx, 0x659494
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11d4]
lea edx, [ebp - 0x11d0]
call fcn.00646cac
mov eax, dword [ebp - 0x11d0]
push eax
mov ecx, 0x6594ac
mov edx, 0x6594d4
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x655a46
push 0
mov ecx, 0x6594f0
mov edx, 0x659518
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x659534
mov edx, 0x65955c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659574
mov edx, 0x65959c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6595b8
mov edx, 0x6595e8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x655b21
push 0
lea eax, [ebp - 0x11dc]
push eax
mov ecx, 0x659600
mov edx, 0x659638
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11dc]
lea edx, [ebp - 0x11d8]
call fcn.00646cac
mov eax, dword [ebp - 0x11d8]
push eax
mov ecx, 0x659650
mov edx, 0x659670
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11e4]
push eax
mov ecx, 0x65968c
mov edx, 0x6596c4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11e4]
lea edx, [ebp - 0x11e0]
call fcn.00646cac
mov eax, dword [ebp - 0x11e0]
push eax
mov ecx, 0x6596dc
mov edx, 0x659704
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x659720
mov edx, 0x65973c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x655d93
push 0
mov ecx, 0x659754
mov edx, 0x65977c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659794
mov edx, 0x6597bc
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11ec]
push eax
mov ecx, 0x6597d8
mov edx, 0x6597f8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11ec]
lea edx, [ebp - 0x11e8]
call fcn.00646cac
mov eax, dword [ebp - 0x11e8]
push eax
mov ecx, 0x659810
mov edx, 0x659830
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x65984c
mov edx, 0x65987c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659894
mov edx, 0x6598c4
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6598e0
mov edx, 0x659914
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x65992c
mov edx, 0x659960
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65997c
mov edx, 0x6599b0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6599c8
mov edx, 0x6599fc
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x659a18
mov edx, 0x659a54
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659a6c
mov edx, 0x659aa8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x659ac4
mov edx, 0x659af0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659b08
mov edx, 0x659b34
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x659b50
mov edx, 0x659b7c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x655cd1
push 0xffffffffffffffff
mov ecx, 0x659b94
mov edx, 0x659bc0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push eax
mov ecx, 0x659bd8
mov edx, 0x659c04
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
jmp 0x655ce7
push 0
mov ecx, 0x659c20
mov edx, 0x659c4c
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
mov ecx, 0x659c68
mov edx, 0x659c98
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x659cb0
mov edx, 0x659ce0
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x11f4]
push eax
mov ecx, 0x659cfc
mov edx, 0x659d2c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11f4]
lea edx, [ebp - 0x11f0]
call fcn.00646cac
mov eax, dword [ebp - 0x11f0]
push eax
mov ecx, 0x659d44
mov edx, 0x659d74
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x11f8]
push eax
mov ecx, 0x659d90
mov edx, 0x659dc0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11f8]
push eax
mov ecx, 0x659dd8
mov edx, 0x659e08
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov byte [0x686907], 0
push 0
mov ecx, 0x659e24
mov edx, 0x659e50
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
jne 0x655de0
lea edx, [ebp - 0x11fc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
mov eax, dword [ebp - 0x11fc]
mov dl, 1
call fcn.00424290
test al, al
je 0x655de0
mov byte [0x686907], 1
cmp byte [0x6868f8], 0
je 0x655e51
xor eax, eax
push ebp
push 0x655e47
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x686984], eax
push 0x659e5c
push 0x659e9c
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00411f08
mov dword [0x68697c], eax
push 0x659eb8
push 0x659e9c
call sub.KERNEL32.DLL_GetModuleHandleW
push eax
call fcn.00411f08
mov dword [0x686980], eax
push 0x686984
call dword [0x68697c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x655e51
push 0x3e8
call sub.KERNEL32.DLL_Sleep_2
push 0x659f00
lea eax, [ebp - 0x1200]
push eax
mov ecx, 0x659f34
mov edx, 0x659f48
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1200]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
xor eax, eax
push ebp
push 0x655f1e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x1204]
xor eax, eax
call fcn.00406c04
mov ecx, dword [ebp - 0x1204]
mov dl, 1
mov eax, dword [0x492d54]
call fcn.004b5f08
mov dword [0x6868b4], eax
mov eax, dword [0x6868e0]
xor edx, edx
push edx
push eax
mov eax, dword [0x6868b4]
call fcn.004b3940
push 0xff00
lea eax, [ebp - 0x1208]
mov ecx, 0x659f64
mov edx, dword [0x686918]
call fcn.0040a390
mov ecx, dword [ebp - 0x1208]
mov dl, 1
mov eax, dword [0x492d54]
call fcn.004b5f08
mov dword [0x6868b8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x655f73
xor esi, esi
mov eax, dword [0x6868e4]
sub eax, esi
cmp eax, 0x1000
jb 0x655f9c
lea edx, [ebp - 0x1090]
mov ecx, 0x1000
mov eax, dword [0x6868b4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x655fb0
mov ecx, eax
lea edx, [ebp - 0x1090]
mov eax, dword [0x6868b4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x1090]
mov ecx, ebx
mov eax, dword [0x6868b8]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x6868e4]
mov dword [ebp - 0x1210], eax
xor eax, eax
mov dword [ebp - 0x120c], eax
fild qword [ebp - 0x1210]
fdivr dword [0x659f84]
mov dword [ebp - 0x1210], esi
xor eax, eax
mov dword [ebp - 0x120c], eax
fild qword [ebp - 0x1210]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x434]
call fcn.00577364
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
cmp ebx, 0x1000
je 0x655f75
mov eax, dword [0x6868b8]
call fcn.004078f0
mov eax, dword [0x6868b4]
call fcn.004078f0
push 0x659f94
lea eax, [ebp - 0x1214]
push eax
mov ecx, 0x659fc4
mov edx, 0x659fd4
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1214]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov dl, 1
mov eax, dword [0x6213b8]
call fcn.00627508
mov dword [0x6868bc], eax
xor eax, eax
push ebp
push 0x6560cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1218]
mov ecx, 0x659ff0
mov edx, dword [0x686918]
call fcn.0040a390
mov edx, dword [ebp - 0x1218]
mov cl, 1
mov eax, dword [0x6868bc]
call fcn.00627588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656120
mov dl, 1
mov eax, dword [0x48fec4]
call fcn.004b3874
mov dword [ebp - 4], eax
mov byte [ebp - 0x6f], 0
push 0
mov ecx, 0x65a01c
mov edx, 0x65a040
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x6c], eax
push 0
mov ecx, 0x65a058
mov edx, 0x65a084
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x656170
mov eax, 0x65a09c
call fcn.0058ad6c
mov byte [0x686908], 0
mov byte [0x686909], 0
lea eax, [ebp - 0x10]
call fcn.0040956c
push 0
mov ecx, 0x65a0f0
mov edx, 0x65a114
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x68690c], eax
push 0
mov ecx, 0x65a12c
mov edx, 0x65a150
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [0x686910], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4d4]
cmp byte [eax + 0x69], 0
je 0x6562d8
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4d8]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6562d8
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4d8]
mov edx, dword [ebp - 0x60]
call fcn.00642594
test al, al
jne 0x6562cc
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.006547b4
cmp dword [ebp - 8], 0
je 0x6562cc
lea edx, [ebp - 0x121c]
mov eax, dword [ebp - 8]
call fcn.0042282c
mov edx, dword [ebp - 0x121c]
lea eax, [ebp - 8]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, 0x65a168
call fcn.0040a4c8
jne 0x65625e
mov byte [0x686908], 1
jmp 0x6562cc
mov eax, dword [ebp - 8]
mov edx, 0x65a18c
call fcn.0040a4c8
jne 0x656276
mov byte [0x686909], 1
jmp 0x6562cc
mov eax, dword [ebp - 8]
mov edx, 0x65a1b0
call fcn.0040a4c8
jne 0x656295
mov byte [0x686908], 1
mov byte [0x686909], 1
jmp 0x6562cc
mov eax, dword [ebp - 8]
mov edx, 0x65a1d0
call fcn.0040a4c8
jne 0x6562b4
mov byte [0x686908], 1
mov byte [0x686909], 1
jmp 0x6562cc
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65a1f4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040a418
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6561f7
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x6e]
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x656de2
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x686901], 0
je 0x656307
push ebp
call fcn.006549d0
pop ecx
cmp byte [0x686908], 0
je 0x65631f
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68690c]
jl 0x656dd6
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1220]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
mov ecx, dword [ebp - 0x1220]
mov edx, 0x65a204
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 8], 0
je 0x656dd6
push 0x65a21c
push dword [0x686944]
push 0x65a244
lea eax, [ebp - 0x1224]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1224]
mov eax, dword [ebp - 8]
call fcn.0040a4c8
je 0x656dd6
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65a258
call fcn.0040a710
test eax, eax
je 0x656dd6
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65a268
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
cmp byte [0x686909], 0
je 0x6563ed
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68690c]
jl 0x6563ed
mov eax, dword [ebp - 0x1c]
mov edx, 0x65a278
call fcn.0040a4c8
jne 0x656dd6
cmp byte [ebp - 0x6e], 0
je 0x6564a1
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00409994
jmp 0x65647e
lea eax, [ebp - 0x1228]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65a2b8
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1228]
push eax
lea edx, [ebp - 0x122c]
mov eax, dword [ebp - 0x1c]
call fcn.0042282c
mov edx, dword [ebp - 0x122c]
mov ecx, 1
pop eax
call fcn.0040a710
test eax, eax
jle 0x65645d
mov bl, 1
jmp 0x656498
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65a2c8
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, 1
call fcn.0040a548
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65a2d8
call fcn.0040a710
test eax, eax
jg 0x656406
cmp bl, 1
je 0x656dd6
lea edx, [ebp - 0x1230]
mov eax, dword [ebp - 0x1c]
call fcn.00646cac
mov edx, dword [ebp - 0x1230]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65a2e8
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.0040a548
mov eax, dword [ebp - 8]
test eax, eax
je 0x6564ea
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x656dd6
lea eax, [ebp - 0x1234]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x1234]
mov edx, 1
call fcn.00423868
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65a2f8
call fcn.0040a710
test eax, eax
jne 0x6565c4
cmp byte [0x686904], 0
jne 0x65656f
lea edx, [ebp - 0x1238]
mov eax, dword [ebp - 0x1c]
call fcn.0064898c
mov edx, dword [ebp - 0x1238]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
call fcn.0054198c
xor eax, eax
push ebp
push 0x6565ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x123c]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
mov edx, dword [ebp - 0x123c]
mov eax, dword [0x6868bc]
call fcn.00628f44
mov edx, eax
lea ecx, [ebp - 0x52]
mov eax, dword [0x6868bc]
call fcn.006264a4
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6565c4
fild dword [ebp - 0x6c]
fdivr dword [0x659f84]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x434]
call fcn.00577364
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65a320
call fcn.0040a710
test eax, eax
jne 0x656864
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f8
test al, al
je 0x656864
cmp byte [0x6868fa], 0
je 0x656632
cmp byte [ebp - 0x18], 0
jne 0x656632
mov byte [ebp - 0x18], 1
cmp byte [ebp - 0x6f], 0
jne case.0x65669d.0
cmp byte [ebp - 0x18], 0
jne case.0x65669d.0
push 0
push 0
lea eax, [ebp - 0x1244]
push eax
mov ecx, 0x65a348
mov edx, 0x65a35c
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1244]
lea ecx, [ebp - 0x1240]
mov edx, dword [ebp - 0x1c]
call fcn.00647908
mov eax, dword [ebp - 0x1240]
movzx ecx, word [0x65a370]
xor edx, edx
call fcn.0058abd4
cmp eax, 0xe
ja case.0x65669d.0
movzx eax, byte [eax + 0x6566a4]
jmp dword [eax*4 + 0x6566b3]
mov byte [ebp - 0x18], 1
jmp case.0x65669d.0
mov byte [ebp - 0x18], 3
jmp case.0x65669d.0
mov byte [ebp - 0x6f], 1
mov byte [ebp - 0x18], 1
jmp case.0x65669d.0
mov byte [ebp - 0x6f], 3
mov byte [ebp - 0x18], 3
jmp case.0x65669d.0
mov eax, dword [ebp - 0x58]
call fcn.00610d54
cmp byte [0x686901], 0
je 0x656dd6
mov eax, dword [0x6868bc]
call fcn.004078f0
push ebp
call fcn.006549d0
pop ecx
jmp 0x656dd6
cmp byte [ebp - 0x18], 1
je 0x656722
cmp byte [ebp - 0x6f], 1
jne 0x65674c
xor eax, eax
push ebp
push 0x656742
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.0042488c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65674c
cmp byte [ebp - 0x18], 3
je 0x656758
cmp byte [ebp - 0x6f], 3
jne 0x656765
mov eax, dword [ebp - 0x1c]
call fcn.006541c4
jmp 0x656dd6
cmp byte [ebp - 0x18], 2
jne 0x656864
push 0
lea edx, [ebp - 0x1248]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
mov edx, dword [ebp - 0x1248]
mov ecx, dword [0x686918]
mov eax, dword [0x6868bc]
call fcn.00627ae4
push dword [0x686918]
push 0x65a380
lea edx, [ebp - 0x1250]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
push dword [ebp - 0x1250]
lea eax, [ebp - 0x124c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x124c]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00654010
test al, al
je 0x65681d
mov eax, dword [ebp - 0x1c]
call fcn.0042488c
push dword [0x686918]
push 0x65a390
lea edx, [ebp - 0x1258]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
push dword [ebp - 0x1258]
lea eax, [ebp - 0x1254]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1254]
call fcn.0042488c
jmp 0x656864
push dword [0x686918]
push 0x65a3a0
lea edx, [ebp - 0x1260]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
push dword [ebp - 0x1260]
lea eax, [ebp - 0x125c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x125c]
call fcn.0042488c
mov eax, dword [ebp - 0x1c]
call fcn.006541c4
jmp 0x656dd6
lea eax, [ebp - 0x1264]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x1264]
mov edx, 0x65a3b0
call fcn.0040a4c8
jne 0x6568c8
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x65689b
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65a3c4
call fcn.0040a710
add eax, 3
jmp 0x6568cd
mov eax, 3
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x6568f6
mov eax, dword [ebp - 0x88]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
sub edx, eax
jl 0x656ad8
inc edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x656acc
lea eax, [ebp - 0x1268]
push eax
mov ebx, dword [ebp - 0x64]
dec ebx
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x1268]
mov dl, 1
call fcn.00424290
test al, al
jne 0x656acc
xor eax, eax
push ebp
push 0x656993
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x126c]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov eax, dword [ebp - 0x126c]
call fcn.004069bc
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656a95
cmp byte [0x6868f9], 0
je 0x656acc
cmp byte [ebp - 0x17], 0
je 0x656acc
lea eax, [ebp - 0x1288]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040a500
mov edx, dword [ebp - 0x1288]
mov eax, 0x65a4a0
call fcn.00648d9c
inc dword [ebp - 0x64]
dec dword [ebp - 0x80]
jne 0x656911
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x65a4bc
call fcn.0040a710
test eax, eax
jg 0x656dd6
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f8
test al, al
je 0x656c17
lea edx, [ebp - 0x128c]
mov eax, dword [ebp - 0x1c]
call fcn.00424b58
mov eax, dword [ebp - 0x128c]
mov edx, 0x65a4e4
call fcn.0040a4c8
jne 0x656b54
push 1
push 0
push 0x65a4fc
push 0x65a540
push 0x65a550
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.KERNEL32.DLL_Sleep_2
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004245c4
test eax, 1
jle 0x656b97
xor eax, eax
push ebp
push 0x656b8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x80
mov eax, dword [ebp - 0x1c]
call fcn.0042467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656b97
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x1c]
call fcn.00424b94
mov eax, dword [ebp - 0x1294]
lea edx, [ebp - 0x1290]
call fcn.0042282c
mov eax, dword [ebp - 0x1290]
mov edx, 0x65a568
call fcn.0040a4c8
je 0x656bf9
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x1c]
call fcn.00424b94
mov eax, dword [ebp - 0x129c]
lea edx, [ebp - 0x1298]
call fcn.0042282c
mov eax, dword [ebp - 0x1298]
mov edx, 0x65a580
call fcn.0040a4c8
jne 0x656c17
mov eax, dword [ebp - 0x1c]
call fcn.006540c4
push 0x12c
call sub.KERNEL32.DLL_Sleep_2
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov byte [ebp - 0x6d], 0
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f8
test al, al
je 0x656c53
xor eax, eax
push ebp
push 0x656c49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.0042488c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656c53
xor eax, eax
push ebp
push 0x656c91
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
mov edx, dword [ebp - 0x12a0]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x6868bc]
call fcn.00627b10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656d4c
cmp byte [ebp - 0x6d], 0
jne 0x656c17
xor eax, eax
push ebp
push 0x656d79
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x4a]
mov eax, dword [ebp - 0x1c]
call fcn.0042452c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656da1
cmp byte [0x6868f9], 0
je 0x656dbd
cmp byte [ebp - 0x17], 0
je 0x656dbd
mov edx, dword [ebp - 0x1c]
mov eax, 0x65a660
call fcn.00648d9c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
cmp dword [ebp - 0x6c], 0x32
jge 0x656dd6
push 0x64
call sub.KERNEL32.DLL_Sleep_2
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6562f7
xor eax, eax
push ebp
push 0x656e0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6868bc]
call fcn.006276f8
mov eax, dword [0x6868bc]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656e18
push 0x65a678
lea eax, [ebp - 0x12b4]
push eax
mov ecx, 0x65a6ac
mov edx, 0x65a6c0
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12b4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov ecx, dword [ebp - 4]
mov edx, 0x65a6dc
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x656f2b
push 0x65a6fc
lea eax, [ebp - 0x12b8]
push eax
mov ecx, 0x65a734
mov edx, 0x65a744
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12b8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x656f1b
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12bc]
push eax
lea ecx, [ebp - 0x12c0]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12c0]
mov edx, 0x65a760
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12bc]
mov eax, dword [ebp - 0x58]
call fcn.0064a470
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x656ed6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
cmp byte [0x6868f9], 0
je 0x656ff2
cmp byte [0x686905], 0
jne 0x656ff2
lea edx, [ebp - 0x12c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x12c8]
push 0x65a780
push dword [0x686944]
lea eax, [ebp - 0x12c4]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12c4]
mov eax, 0x65a790
call fcn.00648d9c
lea edx, [ebp - 0x12d0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x12d0]
push 0x65a7a8
movzx eax, byte [0x65a7ac]
push eax
lea eax, [ebp - 0x12d4]
push eax
mov ecx, 0x65a7bc
mov edx, 0x65a7d4
mov eax, dword [0x686944]
call fcn.0042b824
push dword [ebp - 0x12d4]
lea eax, [ebp - 0x12cc]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12cc]
mov eax, 0x65a7ec
call fcn.00648d9c
push 0
mov ecx, 0x65a804
mov edx, 0x65a81c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657a2d
push 0
mov ecx, 0x65a834
mov edx, 0x65a858
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jle 0x657138
push 0x65a870
lea eax, [ebp - 0x12d8]
push eax
mov ecx, 0x65a8a4
mov edx, 0x65a8b8
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
cmp byte [0x6868fa], 0
je 0x65708f
mov word [ebp - 0x76], 0
jmp 0x657095
mov word [ebp - 0x76], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65a8d4
mov edx, 0x65a904
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0xc], 0
jne 0x6570c2
lea eax, [ebp - 0xc]
mov edx, 0x65a91c
call fcn.00409994
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x6570e5
mov eax, dword [ebp - 0x8c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jle 0x657138
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x657138
mov word [ebp - 0x76], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x657120
mov eax, dword [ebp - 0x90]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x90]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040a500
push 0
mov ecx, 0x65a954
mov edx, 0x65a978
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
je 0x65715d
dec eax
je 0x657265
jmp 0x65741b
push 0
lea eax, [ebp - 0x12e0]
push eax
mov ecx, 0x65a990
mov edx, 0x65a9b8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x12e0]
lea eax, [ebp - 0x12dc]
mov edx, 0x65a9d0
call fcn.0040a390
mov eax, dword [ebp - 0x12dc]
lea edx, [ebp - 8]
call fcn.00646cac
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f8
test al, al
jne 0x6571ba
lea eax, [ebp - 8]
mov edx, dword [0x686938]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241f8
test al, al
je 0x657259
lea edx, [ebp - 0x12e4]
mov eax, 0x65a9f8
call fcn.00646cac
mov eax, dword [ebp - 0x12e4]
mov dl, 1
call fcn.004241f8
test al, al
je 0x657259
movzx eax, word [ebp - 0x76]
push eax
push 1
push 0
push 0x65aa34
push dword [ebp - 8]
push 0x65aa48
push dword [ebp - 0xc]
lea eax, [ebp - 0x12ec]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x12ec]
lea edx, [ebp - 0x12e8]
call fcn.00646cac
mov eax, dword [ebp - 0x12e8]
push eax
lea edx, [ebp - 0x12f0]
mov eax, 0x65aa5c
call fcn.00646cac
mov eax, dword [ebp - 0x12f0]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054ab5c
pop edx
pop ecx
call fcn.0064f30c
jmp 0x65741b
mov byte [0x686900], 1
jmp 0x65741b
push 0
lea eax, [ebp - 0x12f4]
push eax
mov ecx, 0x65aa98
mov edx, 0x65aac0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x12f4]
lea edx, [ebp - 8]
call fcn.00646cac
cmp dword [ebp - 8], 0
je 0x657414
lea edx, [ebp - 0x12f8]
mov eax, dword [ebp - 8]
call fcn.00654350
cmp dword [ebp - 0x12f8], 0
je 0x657414
lea edx, [ebp - 0x12fc]
mov eax, 0x65aad8
call fcn.00646cac
mov eax, dword [ebp - 0x12fc]
mov dl, 1
call fcn.004241f8
test al, al
je 0x657414
push 1
push 1
push 0
push 0x65ab20
push dword [ebp - 8]
push 0x65ab38
lea edx, [ebp - 0x1308]
mov eax, dword [ebp - 8]
call fcn.00654350
push dword [ebp - 0x1308]
push 0x65ab70
lea eax, [ebp - 0x1304]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0x1304]
lea edx, [ebp - 0x1300]
call fcn.00646cac
mov eax, dword [ebp - 0x1300]
push eax
lea edx, [ebp - 0x130c]
mov eax, 0x65ab80
call fcn.00646cac
mov eax, dword [ebp - 0x130c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054ab5c
pop edx
pop ecx
call fcn.0064f30c
test al, al
je 0x65740b
mov eax, dword [0x686924]
mov edx, 0x65abc8
call fcn.0040a4c8
je 0x657402
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
movzx eax, word [ebp - 0x76]
push eax
push 1
push 0
push 0x65abd8
lea edx, [ebp - 0x1318]
mov eax, dword [ebp - 8]
call fcn.00654350
push dword [ebp - 0x1318]
push 0x65ac0c
push dword [ebp - 0xc]
lea eax, [ebp - 0x1314]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x1314]
lea edx, [ebp - 0x1310]
call fcn.00646cac
mov eax, dword [ebp - 0x1310]
push eax
lea edx, [ebp - 0x131c]
mov eax, 0x65ac20
call fcn.00646cac
mov eax, dword [ebp - 0x131c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0054ab5c
pop edx
pop ecx
call fcn.0064f30c
test al, al
jne 0x65741b
mov byte [0x686900], 1
jmp 0x65741b
mov byte [0x686900], 1
jmp 0x65741b
mov byte [0x686900], 1
jmp 0x65741b
mov byte [0x686900], 1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4a0]
cmp byte [eax + 0x69], 0
je 0x65752c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4a0]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x65752c
push 0x65ac5c
lea eax, [ebp - 0x1320]
push eax
mov ecx, 0x65ac9c
mov edx, 0x65acac
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1320]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0x1f4
call sub.KERNEL32.DLL_Sleep_2
mov ecx, dword [ebp - 4]
mov edx, 0x65acc8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x657500
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1324]
push eax
lea ecx, [ebp - 0x1328]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1328]
mov edx, 0x65acec
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1324]
mov eax, dword [ebp - 0x58]
call fcn.0064d224
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6574bb
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov ecx, dword [ebp - 4]
mov edx, 0x65ad10
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x65760e
push 0x65ad30
lea eax, [ebp - 0x132c]
push eax
mov ecx, 0x65ad78
mov edx, 0x65ad88
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x132c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0x1f4
call sub.KERNEL32.DLL_Sleep_2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6575fe
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x686901], 0
jne 0x6575fe
push 0
lea eax, [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x1334]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1334]
mov edx, 0x65ada4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1330]
mov eax, dword [ebp - 0x58]
call fcn.0064b9c4
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6575b0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov ecx, dword [ebp - 4]
mov edx, 0x65adc4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6576cb
push 0x65add8
lea eax, [ebp - 0x1338]
push eax
mov ecx, 0x65ae14
mov edx, 0x65ae24
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1338]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, 0x68694c
call fcn.0040956c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6576cb
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x1340]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1340]
mov edx, 0x65ae40
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x133c]
mov eax, dword [ebp - 0x58]
call fcn.0064c9f0
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x657686
push 0
mov ecx, 0x65ae54
mov edx, 0x65ae80
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657729
push 0xffffffffffffffff
mov ecx, 0x65ae98
mov edx, 0x65aec4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x657729
cmp byte [0x6868ff], 0
je 0x65771c
mov edx, 0x65aedc
mov eax, dword [ebp - 0x58]
call fcn.0064b9c4
jmp 0x657729
mov edx, 0x65afe8
mov eax, dword [ebp - 0x58]
call fcn.0064b9c4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c4]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x6577a5
cmp byte [0x6868ff], 0
je 0x657777
push 0x65b0f4
push dword [0x686920]
push 0x65b190
lea eax, [ebp - 0x1344]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1344]
mov eax, dword [ebp - 0x58]
call fcn.0064b9c4
jmp 0x6577a5
push 0x65b1c4
push dword [0x686920]
push 0x65b260
lea eax, [ebp - 0x1348]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1348]
mov eax, dword [ebp - 0x58]
call fcn.0064b9c4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov ecx, dword [ebp - 4]
mov edx, 0x65b294
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6578b8
push 0x65b2bc
lea eax, [ebp - 0x134c]
push eax
mov ecx, 0x65b304
mov edx, 0x65b314
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x134c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x657868
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1350]
push eax
lea ecx, [ebp - 0x1354]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1354]
mov edx, 0x65b330
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1350]
mov eax, dword [ebp - 0x58]
call fcn.0064deec
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x657823
xor eax, eax
push ebp
push 0x65789e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x74]
push eax
push 0x1388
push 2
push 0x65b34c
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6578a8
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
push 0x65b370
lea eax, [ebp - 0x1358]
push eax
mov ecx, 0x65b3a4
mov edx, 0x65b3b8
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
mov ecx, dword [ebp - 4]
mov edx, 0x65b3d4
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x657967
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x1360]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1360]
mov edx, 0x65b3f0
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x135c]
mov eax, dword [ebp - 0x58]
call fcn.006508e8
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x657922
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054198c
mov ecx, dword [ebp - 4]
mov edx, 0x65b40c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x657a2d
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1364]
push eax
lea ecx, [ebp - 0x1368]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1368]
mov edx, 0x65b42c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1364]
mov ax, 4
call fcn.0065131c
push 0
lea eax, [ebp - 0x136c]
push eax
lea ecx, [ebp - 0x1370]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1370]
mov edx, 0x65b44c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x136c]
mov ax, 5
call fcn.0065131c
inc dword [ebp - 0x60]
dec dword [ebp - 0x7c]
jne 0x6579a5
cmp byte [0x6868f8], 0
je 0x657a64
xor eax, eax
push ebp
push 0x657a5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x686984]
push eax
call dword [0x686980]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657a64
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x434]
mov edx, 0x64
call fcn.00577364
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0x1f4
call sub.KERNEL32.DLL_Sleep_2
push 0x65b46c
lea eax, [ebp - 0x1374]
push eax
mov ecx, 0x65b4a0
mov edx, 0x65b4b4
mov eax, dword [0x6868f0]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1374]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x430]
call fcn.0054198c
cmp byte [0x6868f9], 0
je 0x657ae9
push 0
mov ecx, 0x65b4d0
mov edx, 0x65b4f8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657ae9
call fcn.00653170
push 0
mov ecx, 0x65b510
mov edx, 0x65b540
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x657b21
push 0
mov ecx, 0x65b558
mov edx, 0x65b58c
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657bcd
lea edx, [ebp - 0x1378]
mov eax, 0x65b5a4
call fcn.00646cac
mov eax, dword [ebp - 0x1378]
mov dl, 1
call fcn.004241f8
test al, al
je 0x657bcd
xor eax, eax
push ebp
push 0x657bc3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x137c]
mov eax, 0x65b5ec
call fcn.00646cac
mov eax, dword [ebp - 0x137c]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1380]
mov ecx, 0x65b630
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x1380]
call fcn.0040a13c
push eax
call sub.KERNEL32.DLL_CopyFileW
lea edx, [ebp - 0x1384]
mov eax, 0x65b65c
call fcn.00646cac
mov edx, dword [ebp - 0x1384]
mov eax, 0x65b6a0
call fcn.00648d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657bcd
xor eax, eax
push ebp
push 0x657bf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x686954]
call fcn.004078f0
mov eax, dword [ebp - 4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657c01
cmp byte [0x686907], 0
je 0x657c43
lea edx, [ebp - 0x1388]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
mov eax, dword [ebp - 0x1388]
call fcn.006543e8
test al, al
jne 0x657c43
push 0
mov ecx, 0x65b6b8
mov edx, 0x65b6e4
mov eax, dword [0x6868f4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
xor eax, eax
push ebp
push 0x657c6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6868f4]
mov edx, dword [eax]
call dword [edx + 0x60]
mov eax, dword [0x6868f4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657c79
cmp byte [0x6868f9], 0
je 0x657e1b
cmp byte [0x686905], 0
jne 0x657d9d
push 0
lea edx, [ebp - 0x1390]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x1390]
push 0x65b700
push dword [0x686944]
lea eax, [ebp - 0x138c]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x138c]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1394]
mov ecx, 0x65b710
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x1394]
call fcn.0040a13c
push eax
call sub.KERNEL32.DLL_CopyFileW
test eax, eax
je 0x657d96
push 0
lea edx, [ebp - 0x139c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x139c]
push 0x65b73c
movzx eax, byte [0x65a7ac]
push eax
lea eax, [ebp - 0x13a0]
push eax
mov ecx, 0x65b74c
mov edx, 0x65b764
mov eax, dword [0x686944]
call fcn.0042b824
push dword [ebp - 0x13a0]
lea eax, [ebp - 0x1398]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1398]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13a4]
mov ecx, 0x65b77c
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x13a4]
call fcn.0040a13c
push eax
call sub.KERNEL32.DLL_CopyFileW
test eax, eax
jne 0x657d9d
mov byte [0x686900], 1
cmp byte [0x686905], 0
je 0x657e1b
push 0
lea edx, [ebp - 0x13ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
push dword [ebp - 0x13ac]
push 0x65b7a8
push dword [0x686948]
lea eax, [ebp - 0x13a8]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x13a8]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x13b0]
mov ecx, 0x65b7b8
mov edx, dword [0x686918]
call fcn.0040a390
mov eax, dword [ebp - 0x13b0]
call fcn.0040a13c
push eax
call sub.KERNEL32.DLL_CopyFileW
test eax, eax
jne 0x657e1b
mov byte [0x686900], 1
push 0
mov ecx, 0x65b7e4
mov edx, 0x65b810
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657ebb
push 0xffffffffffffffff
mov ecx, 0x65b828
mov edx, 0x65b854
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x657ebb
push 5
push 0
push 1
lea edx, [ebp - 0x13b8]
mov eax, dword [ebp - 0x60]
call fcn.004235bc
mov ecx, dword [ebp - 0x13b8]
lea eax, [ebp - 0x13b4]
mov edx, 0x65b86c
call fcn.0040a390
mov eax, dword [ebp - 0x13b4]
push eax
lea edx, [ebp - 0x13bc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00541938
lea eax, [ebp - 0x13bc]
mov edx, 0x65b898
call fcn.0040a338
mov edx, dword [ebp - 0x13bc]
xor eax, eax
pop ecx
call fcn.0064f30c
mov eax, dword [0x68056c]
mov eax, dword [eax]
call fcn.00615f44
push 0
mov ecx, 0x65b8c0
mov edx, 0x65b8d8
mov eax, dword [0x6868ec]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x657ee8
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65806b
lea eax, [ebp - 0x13bc]
call fcn.0040956c
lea eax, [ebp - 0x13b8]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x13ac]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x13a4]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x139c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1394]
call fcn.0040956c
lea eax, [ebp - 0x1390]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x1384]
mov edx, 0x2d
call fcn.004095cc
lea eax, [ebp - 0x12d0]
mov edx, 4
call fcn.004095cc
lea eax, [ebp - 0x12c0]
mov edx, 0x25
call fcn.004095cc
lea eax, [ebp - 0x122c]
mov edx, 7
call fcn.004095cc
lea eax, [ebp - 0x1208]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x11fc]
call fcn.0040956c
lea eax, [ebp - 0x11f8]
mov edx, 0xe
call fcn.004095cc
lea eax, [ebp - 0x11c0]
call fcn.0040956c
lea eax, [ebp - 0x11bc]
mov edx, 0x40
call fcn.004095cc
lea eax, [ebp - 0x10bc]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x10b4]
call fcn.0040956c
lea eax, [ebp - 0x10b0]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x10a8]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x1098]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x109c]
call fcn.0040956c
lea eax, [ebp - 0x52]
mov edx, dword [0x621068]
call fcn.0040aa44
lea eax, [ebp - 0x1c]
mov edx, dword [0x654970]
call fcn.0040aa44
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004095cc
ret