Function at 0x656634
Capabilities:
Copy file
Create process on windows
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27c
push 0
push 0
dec ecx
jne 0x65663c
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x656498]
call fcn.0040c7ac
lea eax, [ebp - 0x52]
mov edx, dword [0x61e870]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x659f30
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x688229], 0
lea edx, [ebp - 0x10d4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00427480
mov eax, dword [ebp - 0x10d0]
lea edx, [ebp - 0x10cc]
call fcn.00431290
mov edx, dword [ebp - 0x10cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.0055156c
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x659f50
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.00646850
mov edx, dword [ebp - 0x10d8]
mov eax, 0x688254
call fcn.0040b854
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
xor edx, edx
call fcn.0058efec
push 0x659f84
lea eax, [ebp - 0x10e0]
push eax
mov ecx, 0x659fac
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
push 0
mov ecx, 0x659fdc
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov byte [0x68822c], al
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
xor eax, eax
mov dword [0x68829c], eax
xor eax, eax
mov dword [0x6882a0], eax
xor eax, eax
mov dword [0x6882a4], eax
xor eax, eax
mov dword [0x6882a8], eax
mov dl, 1
mov eax, dword [0x487cf0]
call fcn.004b3ed4
mov dword [0x688288], eax
cmp byte [0x68822d], 0
je 0x656963
lea edx, [ebp - 0x10e4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x10e4]
push 0x65a004
lea ecx, [ebp - 0x10e8]
mov edx, 0x65a014
mov eax, dword [0x688278]
call fcn.00429140
push dword [ebp - 0x10e8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c2e8
lea edx, [ebp - 0x10ec]
mov eax, dword [ebp - 8]
call fcn.00643798
mov eax, dword [ebp - 0x10ec]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x656963
push 0
lea eax, [ebp - 0x10f0]
mov ecx, 0x65a02c
mov edx, dword [0x68824c]
call fcn.0040c260
mov eax, dword [ebp - 0x10f0]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x10f4]
mov eax, dword [ebp - 8]
call fcn.00643798
mov eax, dword [ebp - 0x10f4]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x656963
lea eax, [ebp - 0x10f8]
mov ecx, 0x65a02c
mov edx, dword [0x68824c]
call fcn.0040c260
mov ecx, dword [ebp - 0x10f8]
mov dl, 1
mov eax, dword [0x50f1a8]
call fcn.00512cb8
mov dword [0x68821c], eax
mov ecx, dword [0x688288]
mov edx, 0x65a058
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6568f9
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x10fc]
mov eax, dword [0x688288]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10fc]
push eax
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.0042802c
inc eax
mov dword [0x6882a4], eax
mov ecx, dword [0x688288]
mov edx, 0x65a070
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x656959
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1100]
mov eax, dword [0x688288]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1100]
push eax
mov eax, dword [0x688288]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.0042802c
inc eax
mov dword [0x6882a8], eax
mov eax, dword [0x68821c]
call fcn.00409674
call fcn.0043799c
push eax
lea eax, [ebp - 0x1104]
mov ecx, 0x65a02c
mov edx, dword [0x68824c]
call fcn.0040c260
mov ecx, dword [ebp - 0x1104]
mov dl, 1
mov eax, dword [0x50f1a8]
call fcn.00512cfc
mov dword [0x68821c], eax
cmp byte [0x68822d], 0
je 0x656a13
mov eax, 0x65a09c
call fcn.00643690
test al, al
jne 0x656a13
mov edx, 0x65a0cc
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x6569cf
mov edx, 0x65a0cc
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65a104
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x6569f1
mov edx, 0x65a104
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65a138
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x656a13
mov edx, 0x65a138
mov eax, dword [0x68821c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x65a16c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x656a4b
push 0
mov ecx, 0x65a190
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x656c90
lea edx, [ebp - 0x1108]
mov al, 0x1c
call fcn.00644a78
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x65a1b8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x110c]
mov al, 0x1d
call fcn.00644a78
mov eax, dword [ebp - 0x110c]
push eax
mov ecx, 0x65a1f0
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x65a214
mov edx, 0x65a224
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00646850
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x65a214
mov edx, 0x65a244
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b464
push 0
mov ecx, 0x65a264
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x656b2d
push 0
mov ecx, 0x65a280
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x656b2d
lea eax, [ebp - 8]
mov edx, 0x65a298
call fcn.0040b89c
push 0
lea eax, [ebp - 0x1120]
push eax
mov ecx, 0x65a354
mov edx, 0x65a224
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1120]
lea edx, [ebp - 0x111c]
call fcn.00646850
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x1118]
mov edx, dword [ebp - 8]
call fcn.0040c260
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x65a354
mov edx, 0x65a244
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x1128]
push eax
lea edx, [ebp - 0x112c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x112c]
mov edx, 0x65a224
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1128]
lea edx, [ebp - 0x1124]
call fcn.00646850
mov eax, dword [ebp - 0x1124]
push eax
lea edx, [ebp - 0x1130]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1130]
mov edx, 0x65a244
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x656b91
push 0
mov ecx, 0x65a364
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x656c90
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x1138]
push eax
lea edx, [ebp - 0x113c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x113c]
mov edx, 0x65a364
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1138]
lea edx, [ebp - 0x1134]
call fcn.00646850
mov eax, dword [ebp - 0x1134]
push eax
lea edx, [ebp - 0x1140]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1140]
mov edx, 0x65a364
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x1e
jne 0x656c20
lea edx, [ebp - 0x1144]
mov al, 0x37
call fcn.00644a78
mov eax, dword [ebp - 0x1144]
push eax
mov ecx, 0x65a380
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x688226]
xor al, 1
push eax
mov ecx, 0x65a398
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x688226]
push eax
mov ecx, 0x65a3bc
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x688223]
push eax
mov ecx, 0x65a3dc
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x688220]
push eax
mov ecx, 0x65a3f4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
lea edx, [ebp - 0x1148]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65a408
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x65a42c
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x656d85
mov ecx, 0x65a42c
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x688254], 0
je 0x656da8
mov eax, dword [0x688254]
push eax
mov ecx, 0x659f50
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [ebp - 0x75], 0
mov edx, 0x65a458
mov eax, dword [0x688214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x656e8b
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x3e8]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x65a458
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x16c]
dec eax
test eax, eax
jl 0x656e8b
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1150]
push eax
lea edx, [ebp - 0x1154]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1154]
mov edx, 0x65a458
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00427078
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, 0x65a478
call fcn.0040c52c
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x656e80
mov byte [ebp - 0x75], 1
jmp 0x656e8b
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x656e0d
cmp byte [ebp - 0x75], 0
je 0x656eab
mov eax, dword [0x688268]
push eax
mov ecx, 0x65a4a0
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x688221], 0
je 0x65733e
cmp byte [0x688222], 0
je 0x656ee7
mov eax, 0x65a4cc
call fcn.00643690
test al, al
je 0x656ee7
push 1
mov ecx, 0x65a4f4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x656f12
push 0
mov ecx, 0x65a518
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65a4f4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65a544
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65a544
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65a56c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65a56c
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65a59c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x656fcd
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x65a5cc
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00646850
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65a5cc
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x656fe3
push 0
mov ecx, 0x65a5cc
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65a60c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657059
push 0
lea eax, [ebp - 0x1168]
push eax
mov ecx, 0x65a640
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00644870
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00646850
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x65a640
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x65706f
push 0
mov ecx, 0x65a640
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65a668
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65a668
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65a690
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657177
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x65a6c0
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.00646850
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x65a6f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x65a718
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.00646850
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x65a750
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65a778
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65a7b4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x6571a3
mov ecx, 0x65a6f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x6571a3
mov ecx, 0x65a6f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65a7dc
call fcn.00643690
push eax
mov ecx, 0x65a808
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65a830
call fcn.00643690
push eax
mov ecx, 0x65a860
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65a890
call fcn.00643690
push eax
mov ecx, 0x65a8c4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65a8f4
call fcn.00643690
test al, al
je 0x657226
push 1
mov ecx, 0x65a924
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657252
mov ecx, 0x65a924
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x657252
mov ecx, 0x65a924
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65a954
call fcn.00643690
test al, al
je 0x657278
push 1
mov ecx, 0x65a988
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x6572a4
mov ecx, 0x65a988
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x6572a4
mov ecx, 0x65a988
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65a9bc
call fcn.00643690
test al, al
je 0x6572ca
push 1
mov ecx, 0x65a9f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x6572f6
mov ecx, 0x65a9f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x6572f6
mov ecx, 0x65a9f8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65aa30
call fcn.00643690
test al, al
je 0x65731a
push 0
mov ecx, 0x65aa60
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65aa88
call fcn.00643690
test al, al
je 0x65733e
push 1
mov ecx, 0x65aab0
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65a364
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65766a
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x65aad0
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.00646850
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x65aad0
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65aaf0
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65766a
push 1
mov ecx, 0x65aaf0
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ab18
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ab18
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ab48
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ab48
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ab7c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ab7c
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65abac
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65abac
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65abac
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6574fc
push 0xffffffffffffffff
mov ecx, 0x65abd8
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65abd8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65ac04
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657512
push 1
mov ecx, 0x65ac04
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657512
push 0
mov ecx, 0x65abd8
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65ac34
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657542
push 1
mov ecx, 0x65ac34
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ac68
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65ac68
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ac68
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6575b2
push 0
mov ecx, 0x65aca4
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65aca4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x65acd4
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.00646850
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x65acd4
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x65ad04
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x118c], 0
je 0x65766a
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65ad04
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00646850
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x65ad04
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0x65ad34
lea eax, [ebp - 0x1198]
push eax
mov ecx, 0x65ad68
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1198]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x688220], 0
je 0x657725
xor eax, eax
push ebp
push 0x65771b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x6882b8], eax
push 0x65ad70
push 0x65adb0
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x6882b0], eax
push 0x65adcc
push 0x65adb0
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x6882b4], eax
push 0x6882b8
call dword [0x6882b0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657725
xor eax, eax
push ebp
push 0x6577a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x119c]
xor eax, eax
call fcn.00407414
mov ecx, dword [ebp - 0x119c]
mov dl, 1
mov eax, dword [0x48afa8]
call fcn.004b61a8
mov dword [0x6881e4], eax
mov eax, dword [0x688208]
xor edx, edx
push edx
push eax
mov eax, dword [0x6881e4]
call fcn.004b4108
push 0xff00
lea eax, [ebp - 0x11a0]
mov ecx, 0x65ae14
mov edx, dword [0x68824c]
call fcn.0040c260
mov ecx, dword [ebp - 0x11a0]
mov dl, 1
mov eax, dword [0x48afa8]
call fcn.004b61a8
mov dword [0x6881e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6577fd
xor esi, esi
mov eax, dword [0x68820c]
sub eax, esi
cmp eax, 0x1000
jb 0x657826
lea edx, [ebp - 0x10c8]
mov ecx, 0x1000
mov eax, dword [0x6881e4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x657840
mov ecx, dword [0x68820c]
sub ecx, esi
lea edx, [ebp - 0x10c8]
mov eax, dword [0x6881e4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10c8]
mov ecx, ebx
mov eax, dword [0x6881e8]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x68820c]
mov dword [ebp - 0x11a8], eax
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fdivr dword [0x65ae34]
mov dword [ebp - 0x11a8], esi
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058efec
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
cmp ebx, 0x1000
je 0x6577ff
mov eax, dword [0x6881e8]
call fcn.00409674
mov eax, dword [0x6881e4]
call fcn.00409674
push 0x65ae44
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65ae74
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
mov dl, 1
mov eax, dword [0x61efc4]
call fcn.00625ec8
mov dword [0x6881ec], eax
xor eax, eax
push ebp
push 0x65795b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11b0]
mov ecx, 0x65ae14
mov edx, dword [0x68824c]
call fcn.0040c260
mov edx, dword [ebp - 0x11b0]
mov cl, 1
mov eax, dword [0x6881ec]
call fcn.00625f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6579b0
mov dl, 1
mov eax, dword [0x487cf0]
call fcn.004b3ed4
mov dword [ebp - 4], eax
mov byte [ebp - 0x7d], 0
push 0
mov ecx, 0x65ae84
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, 0x65aea8
call fcn.00643690
xor al, 1
mov byte [ebp - 0x79], al
mov eax, 0x65aed0
call fcn.00643690
xor al, 1
mov byte [ebp - 0x7b], al
mov eax, 0x65aef8
call fcn.00643690
mov byte [ebp - 0x7a], al
mov eax, 0x65af24
call fcn.00643690
mov byte [0x688227], al
mov eax, 0x65af4c
call fcn.00643690
xor al, 1
mov byte [0x688233], al
mov eax, 0x65af80
call fcn.00643690
xor al, 1
mov byte [0x688234], al
mov eax, 0x65afa8
call fcn.00643690
mov byte [0x688235], al
mov eax, 0x65afd8
call fcn.00643690
mov byte [ebp - 0x7c], al
mov byte [0x688230], 0
mov byte [0x688231], 0
lea eax, [ebp - 0x10]
call fcn.0040b464
push 0
mov ecx, 0x65b010
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x688238], eax
push 0
mov ecx, 0x65b034
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68823c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4ec]
cmp byte [eax + 0x69], 0
je 0x657bc2
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f0]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x657bc2
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f0]
mov edx, dword [ebp - 0x60]
call fcn.00641598
test al, al
jne 0x657bb3
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.006562a0
cmp dword [ebp - 8], 0
je 0x657bb3
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 8]
call fcn.00427078
mov edx, dword [ebp - 0x11b4]
lea eax, [ebp - 8]
call fcn.0040b89c
mov eax, dword [ebp - 8]
mov edx, 0x65b058
call fcn.0040c398
jne 0x657b45
mov byte [0x688230], 1
jmp 0x657bb3
mov eax, dword [ebp - 8]
mov edx, 0x65b07c
call fcn.0040c398
jne 0x657b5d
mov byte [0x688231], 1
jmp 0x657bb3
mov eax, dword [ebp - 8]
mov edx, 0x65b0a0
call fcn.0040c398
jne 0x657b7c
mov byte [0x688230], 1
mov byte [0x688231], 1
jmp 0x657bb3
mov eax, dword [ebp - 8]
mov edx, 0x65b0c0
call fcn.0040c398
jne 0x657b9b
mov byte [0x688230], 1
mov byte [0x688231], 1
jmp 0x657bb3
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65b0e4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c2e8
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x657ade
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x77]
push 0xffffffffffffffff
mov ecx, 0x65b0f4
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x658ba2
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x688229], 0
je 0x657c5b
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x11b8]
mov eax, dword [ebp - 0x74]
call fcn.00427d98
mov eax, dword [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x11bc]
mov ecx, 0x65b120
mov edx, dword [0x68824c]
call fcn.0040c260
mov ecx, dword [ebp - 0x11bc]
mov eax, dword [0x6881ec]
pop edx
call fcn.006270c4
mov eax, dword [0x6881ec]
call fcn.00409674
push ebp
call fcn.006564f8
pop ecx
cmp byte [0x688230], 0
je 0x657c73
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x688238]
jl 0x658b93
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11c0]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x11c0]
mov edx, 0x65a058
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x657ca6
mov al, 1
jmp 0x657cc8
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65b14c
call fcn.0040c52c
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
sete al
test al, al
jne 0x658b93
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65b14c
call fcn.0040c52c
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xa0]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
cmp byte [0x688231], 0
je 0x657d5c
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x688238]
jl 0x657d5c
mov eax, dword [ebp - 0x1c]
mov edx, 0x65b15c
call fcn.0040c398
je 0x657d5c
mov eax, dword [ebp - 0x1c]
mov edx, 0x65b19c
call fcn.0040c398
je 0x657d5c
lea eax, [ebp - 0x11c4]
mov ecx, dword [0x688278]
mov edx, 0x65b1e0
call fcn.0040c260
mov edx, dword [ebp - 0x11c4]
mov eax, dword [ebp - 0x1c]
call fcn.0040c398
jne 0x658b93
cmp byte [ebp - 0x77], 0
je 0x657e3d
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b89c
jmp 0x657e17
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65b0e4
call fcn.0040c52c
mov esi, eax
lea eax, [ebp - 0x11c8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c3d0
mov edi, dword [ebp - 0x11c8]
lea edx, [ebp - 0x11cc]
mov eax, dword [ebp - 0x1c]
call fcn.00427078
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0xa4], eax
mov ecx, 1
mov edx, dword [ebp - 0xa4]
mov eax, edi
call fcn.0040c52c
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jle 0x657dec
mov byte [ebp - 0x78], 1
jmp 0x657e33
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65b0e4
call fcn.0040c52c
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov edx, 1
call fcn.0040c418
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65b0e4
call fcn.0040c52c
mov ebx, eax
test ebx, ebx
jg 0x657d7a
cmp byte [ebp - 0x78], 1
je 0x658b93
lea edx, [ebp - 0x11d0]
mov eax, dword [ebp - 0x1c]
call fcn.00646850
mov edx, dword [ebp - 0x11d0]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65b14c
call fcn.0040c52c
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xb0]
mov edx, 1
call fcn.0040c418
cmp dword [ebp - 0x1c], 0
jne 0x657e8e
mov al, 1
jmp 0x657ea0
mov eax, dword [ebp - 8]
test eax, eax
je 0x657e9a
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x658b93
lea eax, [ebp - 0x11d4]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x11d4]
mov edx, 1
call fcn.0042802c
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x657eeb
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x658223
cmp byte [0x68822c], 0
jne 0x657f25
lea edx, [ebp - 0x11d8]
mov eax, dword [ebp - 0x1c]
call fcn.00648020
mov edx, dword [ebp - 0x11d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
call fcn.0055156c
fild dword [ebp - 0x6c]
fdivr dword [0x65b1fc]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
add edx, 0x1e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058efec
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
lea edx, [ebp - 0x11dc]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x11dc]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x658223
movzx eax, byte [ebp - 0x17]
and al, byte [ebp - 0x7c]
je 0x657f87
mov byte [ebp - 0x17], 0
cmp byte [ebp - 0x18], 0
jne case.0x658000.0
cmp byte [0x688222], 0
je 0x657fa3
mov byte [ebp - 0x18], 1
jmp case.0x658000.0
cmp byte [ebp - 0x7d], 0
jne 0x658054
push 0
push 0
lea eax, [ebp - 0x11e4]
push eax
mov ecx, 0x659fac
mov edx, 0x65a244
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11e4]
lea ecx, [ebp - 0x11e0]
mov edx, dword [ebp - 0x1c]
call fcn.00647414
mov eax, dword [ebp - 0x11e0]
movzx ecx, word [0x65b200]
xor edx, edx
call fcn.005a3154
cmp eax, 0xe
ja case.0x658000.0
movzx eax, byte [eax + 0x658007]
jmp dword [eax*4 + 0x658016]
mov byte [ebp - 0x18], 1
jmp case.0x658000.0
mov byte [ebp - 0x18], 3
jmp case.0x658000.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x7d], 1
jmp case.0x658000.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x7d], 3
jmp case.0x658000.0
mov byte [ebp - 0x18], 3
jmp case.0x658000.0
movzx eax, byte [ebp - 0x7d]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 2
jne 0x65814f
xor eax, eax
push ebp
push 0x658141
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x52]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x6881ec]
call fcn.00624908
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
push 0
lea edx, [ebp - 0x11e8]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov edx, dword [ebp - 0x11e8]
mov ecx, dword [0x68824c]
mov eax, dword [0x6881ec]
call fcn.006266e4
push dword [0x68824c]
push 0x65a004
lea edx, [ebp - 0x11f0]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
push dword [ebp - 0x11f0]
lea eax, [ebp - 0x11ec]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11ec]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00655b6c
test al, al
je 0x6580f9
mov byte [ebp - 0x18], 1
jmp 0x6580fd
mov byte [ebp - 0x18], 3
push dword [0x68824c]
push 0x65a004
lea edx, [ebp - 0x11f8]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
push dword [ebp - 0x11f8]
lea eax, [ebp - 0x11f4]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11f4]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65814f
cmp byte [ebp - 0x18], 1
jne 0x6581fe
xor eax, eax
push ebp
push 0x6581f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x688227], 0
je 0x6581d1
push 0
push dword [0x68824c]
push 0x65a004
lea edx, [ebp - 0x1200]
mov eax, dword [ebp - 0x1c]
call fcn.00429384
push dword [ebp - 0x1200]
push 0x65b210
lea eax, [ebp - 0x11fc]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x11fc]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x1204]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1204]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1208]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1208]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6581fe
cmp byte [ebp - 0x18], 3
jne 0x658223
mov eax, 0x65b230
call fcn.00643690
test al, al
jne 0x658b93
mov eax, dword [ebp - 0x1c]
call fcn.00655d58
jmp 0x658b93
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x65822f
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x65826e
lea edx, [ebp - 0x1210]
mov eax, dword [ebp - 0x1c]
call fcn.00429260
mov eax, dword [ebp - 0x1210]
lea edx, [ebp - 0x120c]
call fcn.00643798
mov eax, dword [ebp - 0x120c]
mov dl, 1
call fcn.00428ad4
test al, al
jne 0x6586e0
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x1214]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1214]
mov edx, 0x65b260
call fcn.0040c398
jne 0x658301
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x6582c3
mov eax, dword [ebp - 0xb4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xb4]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65a004
call fcn.0040c52c
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x658331
mov eax, dword [ebp - 0xc0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc0]
sub edx, eax
jl 0x6586d6
inc edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x6586c7
lea eax, [ebp - 0x121c]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x121c]
lea edx, [ebp - 0x1218]
call fcn.00643798
mov eax, dword [ebp - 0x1218]
mov dl, 1
call fcn.00428ad4
test al, al
jne 0x6586c7
xor edx, edx
push ebp
push 0x65842a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1224]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1224]
lea edx, [ebp - 0x1220]
call fcn.00643798
mov eax, dword [ebp - 0x1220]
call fcn.004071c4
call fcn.00407168
cmp byte [0x688221], 0
je 0x65841d
cmp byte [ebp - 0x17], 0
je 0x65841d
lea eax, [ebp - 0x1228]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov edx, dword [ebp - 0x1228]
mov eax, 0x65b274
call fcn.00648794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6586c7
inc dword [ebp - 0x64]
dec dword [ebp - 0x90]
jne 0x65834f
cmp byte [ebp - 0x75], 0
jne 0x658b93
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6586ec
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x658b93
lea edx, [ebp - 0x1268]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1268]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x6588a7
lea edx, [ebp - 0x1270]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1270]
lea edx, [ebp - 0x126c]
call fcn.00427078
mov eax, dword [ebp - 0x126c]
mov edx, 0x65b384
call fcn.0040c398
jne 0x6587b1
mov eax, dword [ebp - 0x1c]
call fcn.00643594
test al, al
je 0x6587b1
push 0
push 0
push 0x65b39c
lea edx, [ebp - 0x1278]
mov eax, dword [ebp - 0x1c]
call fcn.00429384
push dword [ebp - 0x1278]
push 0x65b3d0
lea eax, [ebp - 0x1274]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x1274]
call fcn.0040bffc
push eax
push 0x65b3d8
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x127c]
mov dl, 1
call fcn.00428d34
test eax, 1
jle 0x658816
xor eax, eax
push ebp
push 0x65880c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1280]
mov cl, 1
mov edx, 0x80
call fcn.00428dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658816
lea edx, [ebp - 0x1288]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1288]
lea edx, [ebp - 0x1284]
call fcn.00427078
mov eax, dword [ebp - 0x1284]
mov edx, 0x65b3f4
call fcn.0040c398
je 0x658878
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1290]
lea edx, [ebp - 0x128c]
call fcn.00427078
mov eax, dword [ebp - 0x128c]
mov edx, 0x65b40c
call fcn.0040c398
jne 0x6588a7
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1294]
call fcn.00655c58
push 0x12c
call sub.kernel32.dll_Sleep
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
mov byte [ebp - 0x76], 0
lea edx, [ebp - 0x1298]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x1298]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x658905
xor eax, eax
push ebp
push 0x6588fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x129c]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658905
xor eax, eax
push ebp
push 0x658965
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
movzx eax, byte [ebp - 0x7a]
push eax
movzx eax, byte [ebp - 0x79]
push eax
movzx eax, byte [ebp - 0x7b]
push eax
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x1c]
call fcn.00643798
mov eax, dword [ebp - 0x12a0]
push eax
lea edx, [ebp - 0x12a4]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov edx, dword [ebp - 0x12a4]
mov eax, dword [0x6881ec]
pop ecx
call fcn.006270c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658b46
cmp byte [ebp - 0x76], 0
jne 0x6588a7
cmp byte [ebp - 0x7a], 0
je 0x658b5e
mov eax, dword [ebp - 0x1c]
call fcn.006563b8
cmp byte [0x688221], 0
je 0x658b7a
cmp byte [ebp - 0x17], 0
je 0x658b7a
mov edx, dword [ebp - 0x1c]
mov eax, 0x65a058
call fcn.00648794
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
cmp dword [ebp - 0x6c], 0x32
jge 0x658b93
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x657bfd
xor eax, eax
push ebp
push 0x658bce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6881ec]
call fcn.006260f0
mov eax, dword [0x6881ec]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658bd8
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x63
call fcn.0058efec
push 0x65b59c
lea eax, [ebp - 0x12c8]
push eax
mov ecx, 0x65b5d0
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
mov ecx, dword [ebp - 4]
mov edx, 0x65a458
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x658d04
push 0x65b5e4
lea eax, [ebp - 0x12cc]
push eax
mov ecx, 0x65b61c
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x658cf4
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12d0]
push eax
lea ecx, [ebp - 0x12d4]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12d4]
mov edx, 0x65a458
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12d0]
mov eax, dword [ebp - 0x58]
call fcn.0064aee0
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x658cac
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
cmp byte [0x688221], 0
je 0x658d70
cmp byte [0x68822d], 0
jne 0x658d70
lea edx, [ebp - 0x12dc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x12dc]
push 0x65a004
lea ecx, [ebp - 0x12e0]
mov edx, 0x65a014
mov eax, dword [0x688278]
call fcn.00429140
push dword [ebp - 0x12e0]
lea eax, [ebp - 0x12d8]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x12d8]
mov eax, 0x65a058
call fcn.00648794
push 0
mov ecx, 0x65a280
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65986f
push 0
mov ecx, 0x65b62c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x658ebf
push 0x65ad34
lea eax, [ebp - 0x12e4]
push eax
mov ecx, 0x65ad68
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
cmp byte [0x688222], 0
je 0x658e10
mov word [ebp - 0x86], 0
jmp 0x658e19
mov word [ebp - 0x86], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65b650
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x658e46
lea eax, [ebp - 0xc]
mov edx, 0x65b680
call fcn.0040b89c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x658e69
mov eax, dword [ebp - 0xc4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jle 0x658ebf
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x658ebf
mov word [ebp - 0x86], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x658ea7
mov eax, dword [ebp - 0xc8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc8]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c3d0
push 0
mov ecx, 0x65b62c
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x658ee4
dec eax
je 0x659000
jmp 0x6591b9
push 0
lea eax, [ebp - 0x12ec]
push eax
mov ecx, 0x65b6b8
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x12ec]
lea eax, [ebp - 0x12e8]
mov edx, 0x65b6e0
call fcn.0040c260
mov eax, dword [ebp - 0x12e8]
lea edx, [ebp - 8]
call fcn.00646850
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00428a3c
test al, al
jne 0x658f41
lea eax, [ebp - 8]
mov edx, dword [0x68826c]
call fcn.0040b89c
lea edx, [ebp - 0x12f0]
mov eax, dword [ebp - 8]
call fcn.00643798
mov eax, dword [ebp - 0x12f0]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x658ff4
lea edx, [ebp - 0x12f4]
mov eax, 0x65b708
call fcn.00646850
mov eax, dword [ebp - 0x12f4]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x658ff4
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65b744
push dword [ebp - 8]
push 0x65b758
push dword [ebp - 0xc]
lea eax, [ebp - 0x12fc]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x12fc]
lea edx, [ebp - 0x12f8]
call fcn.00646850
mov eax, dword [ebp - 0x12f8]
push eax
lea edx, [ebp - 0x1300]
mov eax, 0x65b708
call fcn.00646850
mov eax, dword [ebp - 0x1300]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fb70
jmp 0x6591b9
mov byte [0x688228], 1
jmp 0x6591b9
push 0
lea eax, [ebp - 0x1304]
push eax
mov ecx, 0x65b6b8
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1304]
lea edx, [ebp - 8]
call fcn.00646850
cmp dword [ebp - 8], 0
je 0x6591b2
lea edx, [ebp - 0x1308]
mov eax, dword [ebp - 8]
call fcn.00655ebc
cmp dword [ebp - 0x1308], 0
je 0x6591b2
lea edx, [ebp - 0x130c]
mov eax, 0x65b76c
call fcn.00646850
mov eax, dword [ebp - 0x130c]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x6591b2
push 1
push 1
push 0
push 0x65b7b4
push dword [ebp - 8]
push 0x65b7cc
lea edx, [ebp - 0x1318]
mov eax, dword [ebp - 8]
call fcn.00655ebc
push dword [ebp - 0x1318]
push 0x65b804
lea eax, [ebp - 0x1314]
mov edx, 5
call fcn.0040c2e8
mov eax, dword [ebp - 0x1314]
lea edx, [ebp - 0x1310]
call fcn.00646850
mov eax, dword [ebp - 0x1310]
push eax
lea edx, [ebp - 0x131c]
mov eax, 0x65b76c
call fcn.00646850
mov eax, dword [ebp - 0x131c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fb70
test al, al
je 0x6591a9
mov eax, dword [0x688258]
mov edx, 0x65ae74
call fcn.0040c398
je 0x6591a0
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65b814
lea edx, [ebp - 0x1328]
mov eax, dword [ebp - 8]
call fcn.00655ebc
push dword [ebp - 0x1328]
push 0x65b758
push dword [ebp - 0xc]
lea eax, [ebp - 0x1324]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x1324]
lea edx, [ebp - 0x1320]
call fcn.00646850
mov eax, dword [ebp - 0x1320]
push eax
lea edx, [ebp - 0x132c]
mov eax, 0x65b708
call fcn.00646850
mov eax, dword [ebp - 0x132c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fb70
test al, al
jne 0x6591b9
mov byte [0x688228], 1
jmp 0x6591b9
mov byte [0x688228], 1
jmp 0x6591b9
mov byte [0x688228], 1
jmp 0x6591b9
mov byte [0x688228], 1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c0]
cmp byte [eax + 0x69], 0
je 0x6592c3
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x6592c3
push 0x65b848
lea eax, [ebp - 0x1330]
push eax
mov ecx, 0x65b888
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1330]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
mov ecx, dword [ebp - 4]
mov edx, 0x65b898
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659297
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1334]
push eax
lea ecx, [ebp - 0x1338]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1338]
mov edx, 0x65b898
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1334]
call fcn.0064dc78
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659252
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov ecx, dword [ebp - 4]
mov edx, 0x65b8bc
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6593af
push 0x65b8dc
lea eax, [ebp - 0x133c]
push eax
mov ecx, 0x65b924
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x133c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65939f
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x688229], 0
jne 0x65939f
push 0
lea eax, [ebp - 0x1340]
push eax
lea ecx, [ebp - 0x1344]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1344]
mov edx, 0x65b8bc
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1340]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
test al, al
je 0x65939f
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65934a
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, 0x68827c
call fcn.0040b464
mov edx, 0x65b934
mov eax, dword [0x688214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x659444
mov ecx, dword [ebp - 4]
mov edx, 0x65b934
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x659444
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1348]
push eax
lea edx, [ebp - 0x134c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x134c]
mov edx, 0x65b934
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1348]
mov eax, dword [ebp - 0x58]
call fcn.0064d5a8
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x6593ff
push 0
mov ecx, 0x65abac
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6594be
push 0xffffffffffffffff
mov ecx, 0x65abd8
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jne 0x6594be
cmp byte [0x688226], 0
je 0x659490
lea eax, [ebp - 8]
mov edx, 0x65b948
call fcn.0040b89c
jmp 0x65949d
lea eax, [ebp - 8]
mov edx, 0x65b974
call fcn.0040b89c
lea eax, [ebp - 0x1350]
mov ecx, 0x65b9a0
mov edx, dword [ebp - 8]
call fcn.0040c260
mov edx, dword [ebp - 0x1350]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4dc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x659529
cmp byte [0x688226], 0
je 0x6594eb
lea eax, [ebp - 8]
mov edx, 0x65b948
call fcn.0040b89c
jmp 0x6594f8
lea eax, [ebp - 8]
mov edx, 0x65b974
call fcn.0040b89c
push dword [ebp - 8]
push 0x65ba90
push dword [0x688254]
push 0x65bb10
lea eax, [ebp - 0x1354]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov ecx, dword [ebp - 4]
mov edx, 0x65bb44
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659645
push 0x65b8dc
lea eax, [ebp - 0x1358]
push eax
mov ecx, 0x65b924
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6595f2
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x1360]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1360]
mov edx, 0x65bb44
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x135c]
mov eax, dword [ebp - 0x58]
call fcn.0064eb04
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x6595aa
xor eax, eax
push ebp
push 0x65962b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0x1388
push 2
push 0x65bb60
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659635
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
push 0x65b59c
lea eax, [ebp - 0x1364]
push eax
mov ecx, 0x65b5d0
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1364]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
mov edx, 0x65bb84
mov eax, dword [0x688214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x659710
mov ecx, dword [ebp - 4]
mov edx, 0x65bb84
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x659710
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1368]
push eax
lea edx, [ebp - 0x136c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x136c]
mov edx, 0x65bb84
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1368]
mov eax, dword [ebp - 0x58]
call fcn.00650e60
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x6596cb
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov edx, 0x65bba0
mov eax, dword [0x688214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65986f
mov ecx, dword [ebp - 4]
mov edx, 0x65bba0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65986f
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1370]
push eax
lea edx, [ebp - 0x1374]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1374]
mov edx, 0x65bba0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1370]
mov ax, 4
call fcn.00652d38
cmp byte [0x68822b], 0
je 0x6597d5
mov byte [0x688228], 1
cmp byte [0x688220], 0
je 0x6597ce
mov eax, dword [0x6882b8]
push eax
call dword [0x6882b4]
push ebp
call fcn.006564f8
pop ecx
push 0
lea eax, [ebp - 0x1378]
push eax
lea edx, [ebp - 0x137c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x137c]
mov edx, 0x65bba0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1378]
mov ax, 5
call fcn.00652d38
push 0x65b59c
lea eax, [ebp - 0x1380]
push eax
mov ecx, 0x65b5d0
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1380]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65976e
cmp dword [0x688254], 0
je 0x6599ec
lea edx, [ebp - 0x1384]
mov eax, dword [0x688254]
call fcn.00643798
mov eax, dword [ebp - 0x1384]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x6599ec
push 0
mov ecx, 0x65bbc0
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659954
lea edx, [ebp - 0x1388]
mov eax, dword [0x688254]
call fcn.00429384
mov ecx, dword [ebp - 0x1388]
lea eax, [ebp - 8]
mov edx, 0x65bbec
call fcn.0040c260
push dword [ebp - 8]
push 0x65bc7c
push dword [0x688254]
push 0x65bb10
lea eax, [ebp - 0x138c]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x138c]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
push dword [ebp - 8]
push 0x65bca4
lea edx, [ebp - 0x1394]
mov eax, dword [0x688254]
call fcn.00429260
push dword [ebp - 0x1394]
push 0x65bb10
lea eax, [ebp - 0x1390]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1390]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
mov eax, 0x65bcd4
call fcn.00643690
test al, al
je 0x6599a0
push 0x65bcfc
lea edx, [ebp - 0x139c]
mov eax, dword [0x688254]
call fcn.00429384
push dword [ebp - 0x139c]
push 0x65bd60
lea eax, [ebp - 0x1398]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x1398]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
mov eax, 0x65bdc4
call fcn.00643690
test al, al
je 0x6599ec
push 0x65bcfc
lea edx, [ebp - 0x13a4]
mov eax, dword [0x688254]
call fcn.00429384
push dword [ebp - 0x13a4]
push 0x65bde8
lea eax, [ebp - 0x13a0]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x13a0]
mov eax, dword [ebp - 0x58]
call fcn.0064c50c
cmp byte [0x688220], 0
je 0x659a23
xor eax, eax
push ebp
push 0x659a19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6882b8]
push eax
call dword [0x6882b4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659a23
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x64
call fcn.0058efec
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
push 0x65b59c
lea eax, [ebp - 0x13a8]
push eax
mov ecx, 0x65b5d0
mov edx, 0x659fc0
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x13a8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
cmp byte [0x688221], 0
je 0x659a9e
push 0
mov ecx, 0x65be48
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659a9e
call fcn.00654f70
xor eax, eax
push ebp
push 0x659ac8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x688288]
call fcn.00409674
mov eax, dword [ebp - 4]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659ad2
cmp byte [0x68822f], 0
je 0x659b14
lea edx, [ebp - 0x13ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x13ac]
call fcn.00655f54
test al, al
jne 0x659b14
push 0
mov ecx, 0x65a544
mov edx, 0x65a1d4
mov eax, dword [0x68821c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
push ebp
push 0x659b40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68821c]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x68821c]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x659b4a
cmp byte [0x688221], 0
je 0x659bf2
push 0
lea edx, [ebp - 0x13b8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x13b8]
push 0x65a004
lea ecx, [ebp - 0x13bc]
mov edx, 0x65a014
mov eax, dword [0x688278]
call fcn.00429140
push dword [ebp - 0x13bc]
lea eax, [ebp - 0x13b4]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x13b4]
lea edx, [ebp - 0x13b0]
call fcn.00643798
mov eax, dword [ebp - 0x13b0]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13c0]
mov ecx, 0x65a02c
mov edx, dword [0x68824c]
call fcn.0040c260
mov eax, dword [ebp - 0x13c0]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x659bf2
mov byte [0x688228], 1
cmp byte [0x688221], 0
jne 0x659ccd
push 0
mov ecx, 0x65a364
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659ccd
lea edx, [ebp - 0x13c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13c8]
mov edx, 0x65be70
call fcn.0040c208
mov eax, dword [ebp - 0x13c8]
lea edx, [ebp - 0x13c4]
call fcn.00643798
mov eax, dword [ebp - 0x13c4]
mov dl, 1
call fcn.00428a3c
test al, al
jne 0x659ccd
push 0
lea edx, [ebp - 0x13d0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13d0]
mov edx, 0x65be70
call fcn.0040c208
mov eax, dword [ebp - 0x13d0]
lea edx, [ebp - 0x13cc]
call fcn.00643798
mov eax, dword [ebp - 0x13cc]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13d4]
mov ecx, 0x65a02c
mov edx, dword [0x68824c]
call fcn.0040c260
mov eax, dword [ebp - 0x13d4]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x65a364
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659d8b
push 0
mov ecx, 0x65abac
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659d8b
push 0xffffffffffffffff
mov ecx, 0x65abd8
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x659d8b
push 5
push 0
push 1
lea edx, [ebp - 0x13dc]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x13dc]
lea eax, [ebp - 0x13d8]
mov edx, 0x65be98
call fcn.0040c260
mov eax, dword [ebp - 0x13d8]
push eax
lea edx, [ebp - 0x13e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13e0]
mov edx, 0x65bec4
call fcn.0040c208
mov edx, dword [ebp - 0x13e0]
xor eax, eax
pop ecx
call fcn.0064fb70
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.00610390
cmp byte [0x688222], 0
jne 0x659dc1
push 0
mov ecx, 0x65beec
mov edx, 0x659f6c
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659dc1
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x659f3a
lea eax, [ebp - 0x13e0]
call fcn.0040b464
lea eax, [ebp - 0x13dc]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x13d0]
call fcn.0040b464
lea eax, [ebp - 0x13cc]
call fcn.0040b464
lea eax, [ebp - 0x13c8]
call fcn.0040b464
lea eax, [ebp - 0x13c4]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x13b8]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x13b0]
call fcn.0040b464
lea eax, [ebp - 0x13ac]
call fcn.0040b464
lea eax, [ebp - 0x13a8]
mov edx, 0x33
call fcn.0040b4c4
lea eax, [ebp - 0x12dc]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x12d4]
mov edx, 0x1f
call fcn.0040b4c4
lea eax, [ebp - 0x1254]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1258]
call fcn.0040b464
lea eax, [ebp - 0x124c]
mov edx, 0x29
call fcn.0040b4c4
lea eax, [ebp - 0x11a0]
mov edx, 0x16
call fcn.0040b4c4
lea eax, [ebp - 0x1148]
call fcn.0040b464
lea eax, [ebp - 0x1144]
mov edx, 0x18
call fcn.0040b4c4
lea eax, [ebp - 0x10e4]
call fcn.0040b464
lea eax, [ebp - 0x10e0]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x10d4]
call fcn.0040b464
lea eax, [ebp - 0x10d0]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1c]
mov edx, dword [0x656498]
call fcn.0040cb78
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x52]
mov edx, dword [0x61e870]
call fcn.0040cb78
lea eax, [ebp - 0x14]
call fcn.0040b464
pop eax
jmp eax