Function at 0x657044
Capabilities:
Copy file
Create process on windows
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27c
push 0
push 0
dec ecx
jne 0x65704c
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x656e74]
call fcn.0040c7ac
lea eax, [ebp - 0x52]
mov edx, dword [0x61e870]
call fcn.0040c7ac
xor eax, eax
push ebp
push 0x65a96c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x68a22b], 0
mov byte [0x68a229], 0
lea edx, [ebp - 0x10d4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.00427480
mov eax, dword [ebp - 0x10d0]
lea edx, [ebp - 0x10cc]
call fcn.00431290
mov edx, dword [ebp - 0x10cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.0055156c
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x65a98c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.00646978
mov edx, dword [ebp - 0x10d8]
mov eax, 0x68a258
call fcn.0040b854
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
xor edx, edx
call fcn.0058efec
push 0x65a9c0
lea eax, [ebp - 0x10e0]
push eax
mov ecx, 0x65a9e8
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
push 0
mov ecx, 0x65aa18
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov byte [0x68a22e], al
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
xor eax, eax
mov dword [0x68a2b0], eax
xor eax, eax
mov dword [0x68a2b4], eax
xor eax, eax
mov dword [0x68a2b8], eax
xor eax, eax
mov dword [0x68a2bc], eax
mov dl, 1
mov eax, dword [0x487cf0]
call fcn.004b3ed4
mov dword [0x68a29c], eax
cmp byte [0x68a22f], 0
je 0x65737a
lea edx, [ebp - 0x10e4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x10e4]
push 0x65aa40
lea ecx, [ebp - 0x10e8]
mov edx, 0x65aa50
mov eax, dword [0x68a27c]
call fcn.00429140
push dword [ebp - 0x10e8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c2e8
lea edx, [ebp - 0x10ec]
mov eax, dword [ebp - 8]
call fcn.00643830
mov eax, dword [ebp - 0x10ec]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x65737a
push 0
lea eax, [ebp - 0x10f0]
mov ecx, 0x65aa68
mov edx, dword [0x68a250]
call fcn.0040c260
mov eax, dword [ebp - 0x10f0]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x10f4]
mov eax, dword [ebp - 8]
call fcn.00643830
mov eax, dword [ebp - 0x10f4]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x65737a
lea eax, [ebp - 0x10f8]
mov ecx, 0x65aa68
mov edx, dword [0x68a250]
call fcn.0040c260
mov ecx, dword [ebp - 0x10f8]
mov dl, 1
mov eax, dword [0x50f1a8]
call fcn.00512cb8
mov dword [0x68a21c], eax
mov ecx, dword [0x68a29c]
mov edx, 0x65aa94
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x657310
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x10fc]
mov eax, dword [0x68a29c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10fc]
push eax
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.0042802c
inc eax
mov dword [0x68a2b8], eax
mov ecx, dword [0x68a29c]
mov edx, 0x65aaac
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x657370
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1100]
mov eax, dword [0x68a29c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1100]
push eax
mov eax, dword [0x68a29c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.0042802c
inc eax
mov dword [0x68a2bc], eax
mov eax, dword [0x68a21c]
call fcn.00409674
call fcn.0043799c
push eax
lea eax, [ebp - 0x1104]
mov ecx, 0x65aa68
mov edx, dword [0x68a250]
call fcn.0040c260
mov ecx, dword [ebp - 0x1104]
mov dl, 1
mov eax, dword [0x50f1a8]
call fcn.00512cfc
mov dword [0x68a21c], eax
cmp byte [0x68a22f], 0
je 0x65742a
mov eax, 0x65aad8
call fcn.00643738
test al, al
jne 0x65742a
mov edx, 0x65ab08
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x6573e6
mov edx, 0x65ab08
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65ab40
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x657408
mov edx, 0x65ab40
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65ab74
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65742a
mov edx, 0x65ab74
mov eax, dword [0x68a21c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x65aba8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657462
push 0
mov ecx, 0x65abcc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x6576a7
lea edx, [ebp - 0x1108]
mov al, 0x1c
call fcn.00644b10
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x65abf4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x110c]
mov al, 0x1d
call fcn.00644b10
mov eax, dword [ebp - 0x110c]
push eax
mov ecx, 0x65ac2c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x65ac50
mov edx, 0x65ac60
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.00646978
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x65ac50
mov edx, 0x65ac80
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b464
push 0
mov ecx, 0x65aca0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657544
push 0
mov ecx, 0x65acbc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657544
lea eax, [ebp - 8]
mov edx, 0x65acd4
call fcn.0040b89c
push 0
lea eax, [ebp - 0x1120]
push eax
mov ecx, 0x65ad90
mov edx, 0x65ac60
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1120]
lea edx, [ebp - 0x111c]
call fcn.00646978
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x1118]
mov edx, dword [ebp - 8]
call fcn.0040c260
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x65ad90
mov edx, 0x65ac80
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x1128]
push eax
lea edx, [ebp - 0x112c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x112c]
mov edx, 0x65ac60
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1128]
lea edx, [ebp - 0x1124]
call fcn.00646978
mov eax, dword [ebp - 0x1124]
push eax
lea edx, [ebp - 0x1130]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1130]
mov edx, 0x65ac80
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x6575a8
push 0
mov ecx, 0x65ada0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6576a7
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x1138]
push eax
lea edx, [ebp - 0x113c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x113c]
mov edx, 0x65ada0
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1138]
lea edx, [ebp - 0x1134]
call fcn.00646978
mov eax, dword [ebp - 0x1134]
push eax
lea edx, [ebp - 0x1140]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1140]
mov edx, 0x65ada0
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x1e
jne 0x657637
lea edx, [ebp - 0x1144]
mov al, 0x37
call fcn.00644b10
mov eax, dword [ebp - 0x1144]
push eax
mov ecx, 0x65adbc
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x68a225]
xor al, 1
push eax
mov ecx, 0x65add4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a225]
push eax
mov ecx, 0x65adf8
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a223]
push eax
mov ecx, 0x65ae18
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68a220]
push eax
mov ecx, 0x65ae30
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
lea edx, [ebp - 0x1148]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x65ae44
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, 0x65ae68
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65779c
mov ecx, 0x65ae68
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x68a258], 0
je 0x6577bf
mov eax, dword [0x68a258]
push eax
mov ecx, 0x65a98c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [ebp - 0x75], 0
mov edx, 0x65ae94
mov eax, dword [0x68a214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x6578a2
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x3e8]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x65ae94
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0x16c]
dec eax
test eax, eax
jl 0x6578a2
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1150]
push eax
lea edx, [ebp - 0x1154]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1154]
mov edx, 0x65ae94
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1150]
lea edx, [ebp - 0x114c]
call fcn.00427078
mov eax, dword [ebp - 0x114c]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, 0x65aeb4
call fcn.0040c52c
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x657897
mov byte [ebp - 0x75], 1
jmp 0x6578a2
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x657824
cmp byte [ebp - 0x75], 0
je 0x6578c2
mov eax, dword [0x68a26c]
push eax
mov ecx, 0x65aedc
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x68a221], 0
je 0x657d55
cmp byte [0x68a222], 0
je 0x6578fe
mov eax, 0x65af08
call fcn.00643738
test al, al
je 0x6578fe
push 1
mov ecx, 0x65af30
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657929
push 0
mov ecx, 0x65af54
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65af30
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65af80
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65af80
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65afa8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65afa8
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65afd8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x6579e4
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x65b008
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.00646978
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x65b008
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x6579fa
push 0
mov ecx, 0x65b008
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65b048
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657a70
push 0
lea eax, [ebp - 0x1168]
push eax
mov ecx, 0x65b07c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00644908
mov eax, dword [ebp - 0x1164]
lea edx, [ebp - 0x1160]
call fcn.00646978
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x65b07c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x657a86
push 0
mov ecx, 0x65b07c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65b0a4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b0a4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b0cc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657b8e
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x65b0fc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.00646978
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x65b134
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x65b154
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.00646978
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x65b18c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65b1b4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b1f0
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657bba
mov ecx, 0x65b134
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x657bba
mov ecx, 0x65b134
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65b218
call fcn.00643738
push eax
mov ecx, 0x65b244
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65b26c
call fcn.00643738
push eax
mov ecx, 0x65b29c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65b2cc
call fcn.00643738
push eax
mov ecx, 0x65b300
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65b330
call fcn.00643738
test al, al
je 0x657c3d
push 1
mov ecx, 0x65b360
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657c69
mov ecx, 0x65b360
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x657c69
mov ecx, 0x65b360
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65b390
call fcn.00643738
test al, al
je 0x657c8f
push 1
mov ecx, 0x65b3c4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657cbb
mov ecx, 0x65b3c4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x657cbb
mov ecx, 0x65b3c4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65b3f8
call fcn.00643738
test al, al
je 0x657ce1
push 1
mov ecx, 0x65b434
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657d0d
mov ecx, 0x65b434
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x657d0d
mov ecx, 0x65b434
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65b46c
call fcn.00643738
test al, al
je 0x657d31
push 0
mov ecx, 0x65b49c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65b4c4
call fcn.00643738
test al, al
je 0x657d55
push 1
mov ecx, 0x65b4ec
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65ada0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658081
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x65b50c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.00646978
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x65b50c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65b52c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x658081
push 1
mov ecx, 0x65b52c
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b554
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b554
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b584
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b584
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b5b8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b5b8
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b5e8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b5e8
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b5e8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657f13
push 0xffffffffffffffff
mov ecx, 0x65b614
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65b614
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65b640
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657f29
push 1
mov ecx, 0x65b640
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x657f29
push 0
mov ecx, 0x65b614
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65b670
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657f59
push 1
mov ecx, 0x65b670
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b6a4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65b6a4
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65b6a4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x657fc9
push 0
mov ecx, 0x65b6e0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65b6e0
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x65b710
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.00646978
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x65b710
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x118c]
push eax
mov ecx, 0x65b740
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x118c], 0
je 0x658081
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65b740
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00646978
mov eax, dword [ebp - 0x1190]
push eax
mov ecx, 0x65b740
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0x65b770
lea eax, [ebp - 0x1198]
push eax
mov ecx, 0x65b7a4
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1198]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
cmp byte [0x68a220], 0
je 0x65813c
xor eax, eax
push ebp
push 0x658132
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x68a2cc], eax
push 0x65b7ac
push 0x65b7ec
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2c4], eax
push 0x65b808
push 0x65b7ec
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00417260
mov dword [0x68a2c8], eax
push 0x68a2cc
call dword [0x68a2c4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65813c
xor eax, eax
push ebp
push 0x6581bf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x119c]
xor eax, eax
call fcn.00407414
mov ecx, dword [ebp - 0x119c]
mov dl, 1
mov eax, dword [0x48afa8]
call fcn.004b61a8
mov dword [0x68a1e4], eax
mov eax, dword [0x68a208]
xor edx, edx
push edx
push eax
mov eax, dword [0x68a1e4]
call fcn.004b4108
push 0xff00
lea eax, [ebp - 0x11a0]
mov ecx, 0x65b850
mov edx, dword [0x68a250]
call fcn.0040c260
mov ecx, dword [ebp - 0x11a0]
mov dl, 1
mov eax, dword [0x48afa8]
call fcn.004b61a8
mov dword [0x68a1e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658214
xor esi, esi
mov eax, dword [0x68a20c]
sub eax, esi
cmp eax, 0x1000
jb 0x65823d
lea edx, [ebp - 0x10c8]
mov ecx, 0x1000
mov eax, dword [0x68a1e4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x658257
mov ecx, dword [0x68a20c]
sub ecx, esi
lea edx, [ebp - 0x10c8]
mov eax, dword [0x68a1e4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10c8]
mov ecx, ebx
mov eax, dword [0x68a1e8]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x68a20c]
mov dword [ebp - 0x11a8], eax
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fdivr dword [0x65b870]
mov dword [ebp - 0x11a8], esi
xor eax, eax
mov dword [ebp - 0x11a4], eax
fild qword [ebp - 0x11a8]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058efec
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
cmp ebx, 0x1000
je 0x658216
mov eax, dword [0x68a1e8]
call fcn.00409674
mov eax, dword [0x68a1e4]
call fcn.00409674
push 0x65b880
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65b8b0
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
mov dl, 1
mov eax, dword [0x61efc4]
call fcn.00625ec8
mov dword [0x68a1ec], eax
xor eax, eax
push ebp
push 0x658372
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11b0]
mov ecx, 0x65b850
mov edx, dword [0x68a250]
call fcn.0040c260
mov edx, dword [ebp - 0x11b0]
mov cl, 1
mov eax, dword [0x68a1ec]
call fcn.00625f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6583c7
mov dl, 1
mov eax, dword [0x487cf0]
call fcn.004b3ed4
mov dword [ebp - 4], eax
mov byte [ebp - 0x7d], 0
push 0
mov ecx, 0x65b8c0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, 0x65b8e4
call fcn.00643738
xor al, 1
mov byte [ebp - 0x79], al
mov eax, 0x65b90c
call fcn.00643738
xor al, 1
mov byte [ebp - 0x7b], al
mov eax, 0x65b934
call fcn.00643738
mov byte [ebp - 0x7a], al
mov eax, 0x65b960
call fcn.00643738
mov byte [0x68a227], al
mov eax, 0x65b988
call fcn.00643738
xor al, 1
mov byte [0x68a235], al
mov eax, 0x65b9bc
call fcn.00643738
xor al, 1
mov byte [0x68a236], al
mov eax, 0x65b9e4
call fcn.00643738
mov byte [0x68a237], al
mov eax, 0x65ba14
call fcn.00643738
mov byte [ebp - 0x7c], al
mov byte [0x68a232], 0
mov byte [0x68a233], 0
lea eax, [ebp - 0x10]
call fcn.0040b464
push 0
mov ecx, 0x65ba4c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68a23c], eax
push 0
mov ecx, 0x65ba70
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68a240], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4ec]
cmp byte [eax + 0x69], 0
je 0x6585d9
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f0]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6585d9
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4f0]
mov edx, dword [ebp - 0x60]
call fcn.00641598
test al, al
jne 0x6585ca
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.00656c7c
cmp dword [ebp - 8], 0
je 0x6585ca
lea edx, [ebp - 0x11b4]
mov eax, dword [ebp - 8]
call fcn.00427078
mov edx, dword [ebp - 0x11b4]
lea eax, [ebp - 8]
call fcn.0040b89c
mov eax, dword [ebp - 8]
mov edx, 0x65ba94
call fcn.0040c398
jne 0x65855c
mov byte [0x68a232], 1
jmp 0x6585ca
mov eax, dword [ebp - 8]
mov edx, 0x65bab8
call fcn.0040c398
jne 0x658574
mov byte [0x68a233], 1
jmp 0x6585ca
mov eax, dword [ebp - 8]
mov edx, 0x65badc
call fcn.0040c398
jne 0x658593
mov byte [0x68a232], 1
mov byte [0x68a233], 1
jmp 0x6585ca
mov eax, dword [ebp - 8]
mov edx, 0x65bafc
call fcn.0040c398
jne 0x6585b2
mov byte [0x68a232], 1
mov byte [0x68a233], 1
jmp 0x6585ca
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65bb20
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c2e8
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x6584f5
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x77]
push 0xffffffffffffffff
mov ecx, 0x65bb30
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x6595d7
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68a22b], 0
je 0x658678
cmp dword [ebp - 0x74], 0xffffffff
je 0x658667
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x11b8]
mov eax, dword [ebp - 0x74]
call fcn.00427d98
mov eax, dword [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x11bc]
mov ecx, 0x65bb5c
mov edx, dword [0x68a250]
call fcn.0040c260
mov ecx, dword [ebp - 0x11bc]
mov eax, dword [0x68a1ec]
pop edx
call fcn.006270c4
mov eax, dword [0x68a1ec]
call fcn.00409674
push ebp
call fcn.00656ed4
pop ecx
cmp byte [0x68a232], 0
je 0x658690
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68a23c]
jl 0x6595c8
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11c0]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x11c0]
mov edx, 0x65aa94
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x6586c3
mov al, 1
jmp 0x6586e5
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65bb88
call fcn.0040c52c
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
sete al
test al, al
jne 0x6595c8
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65bb88
call fcn.0040c52c
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xa0]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
cmp byte [0x68a233], 0
je 0x658779
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68a23c]
jl 0x658779
mov eax, dword [ebp - 0x1c]
mov edx, 0x65bb98
call fcn.0040c398
je 0x658779
mov eax, dword [ebp - 0x1c]
mov edx, 0x65bbd8
call fcn.0040c398
je 0x658779
lea eax, [ebp - 0x11c4]
mov ecx, dword [0x68a27c]
mov edx, 0x65bc1c
call fcn.0040c260
mov edx, dword [ebp - 0x11c4]
mov eax, dword [ebp - 0x1c]
call fcn.0040c398
jne 0x6595c8
cmp byte [ebp - 0x77], 0
je 0x65885a
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b89c
jmp 0x658834
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65bb20
call fcn.0040c52c
mov esi, eax
lea eax, [ebp - 0x11c8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c3d0
mov edi, dword [ebp - 0x11c8]
lea edx, [ebp - 0x11cc]
mov eax, dword [ebp - 0x1c]
call fcn.00427078
mov eax, dword [ebp - 0x11cc]
mov dword [ebp - 0xa4], eax
mov ecx, 1
mov edx, dword [ebp - 0xa4]
mov eax, edi
call fcn.0040c52c
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jle 0x658809
mov byte [ebp - 0x78], 1
jmp 0x658850
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65bb20
call fcn.0040c52c
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov edx, 1
call fcn.0040c418
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65bb20
call fcn.0040c52c
mov ebx, eax
test ebx, ebx
jg 0x658797
cmp byte [ebp - 0x78], 1
je 0x6595c8
lea edx, [ebp - 0x11d0]
mov eax, dword [ebp - 0x1c]
call fcn.00646978
mov edx, dword [ebp - 0x11d0]
lea eax, [ebp - 0x1c]
call fcn.0040b89c
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65bb88
call fcn.0040c52c
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xb0]
mov edx, 1
call fcn.0040c418
cmp dword [ebp - 0x1c], 0
jne 0x6588ab
mov al, 1
jmp 0x6588bd
mov eax, dword [ebp - 8]
test eax, eax
je 0x6588b7
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x6595c8
lea eax, [ebp - 0x11d4]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040c01c
mov eax, dword [ebp - 0x11d4]
mov edx, 1
call fcn.0042802c
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x658908
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x658c40
cmp byte [0x68a22e], 0
jne 0x658942
lea edx, [ebp - 0x11d8]
mov eax, dword [ebp - 0x1c]
call fcn.00648118
mov edx, dword [ebp - 0x11d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
call fcn.0055156c
fild dword [ebp - 0x6c]
fdivr dword [0x65bc38]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407aa4
mov edx, eax
add edx, 0x1e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
call fcn.0058efec
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
lea edx, [ebp - 0x11dc]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x11dc]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x658c40
movzx eax, byte [ebp - 0x17]
and al, byte [ebp - 0x7c]
je 0x6589a4
mov byte [ebp - 0x17], 0
cmp byte [ebp - 0x18], 0
jne case.0x658a1d.0
cmp byte [0x68a222], 0
je 0x6589c0
mov byte [ebp - 0x18], 1
jmp case.0x658a1d.0
cmp byte [ebp - 0x7d], 0
jne 0x658a71
push 0
push 0
lea eax, [ebp - 0x11e4]
push eax
mov ecx, 0x65a9e8
mov edx, 0x65ac80
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11e4]
lea ecx, [ebp - 0x11e0]
mov edx, dword [ebp - 0x1c]
call fcn.0064753c
mov eax, dword [ebp - 0x11e0]
movzx ecx, word [0x65bc3c]
xor edx, edx
call fcn.005a3154
cmp eax, 0xe
ja case.0x658a1d.0
movzx eax, byte [eax + 0x658a24]
jmp dword [eax*4 + 0x658a33]
mov byte [ebp - 0x18], 1
jmp case.0x658a1d.0
mov byte [ebp - 0x18], 3
jmp case.0x658a1d.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x7d], 1
jmp case.0x658a1d.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x7d], 3
jmp case.0x658a1d.0
mov byte [ebp - 0x18], 3
jmp case.0x658a1d.0
movzx eax, byte [ebp - 0x7d]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 2
jne 0x658b6c
xor eax, eax
push ebp
push 0x658b5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x52]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x68a1ec]
call fcn.00624908
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
push 0
lea edx, [ebp - 0x11e8]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov edx, dword [ebp - 0x11e8]
mov ecx, dword [0x68a250]
mov eax, dword [0x68a1ec]
call fcn.006266e4
push dword [0x68a250]
push 0x65aa40
lea edx, [ebp - 0x11f0]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
push dword [ebp - 0x11f0]
lea eax, [ebp - 0x11ec]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11ec]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00656548
test al, al
je 0x658b16
mov byte [ebp - 0x18], 1
jmp 0x658b1a
mov byte [ebp - 0x18], 3
push dword [0x68a250]
push 0x65aa40
lea edx, [ebp - 0x11f8]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
push dword [ebp - 0x11f8]
lea eax, [ebp - 0x11f4]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x11f4]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658b6c
cmp byte [ebp - 0x18], 1
jne 0x658c1b
xor eax, eax
push ebp
push 0x658c11
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x68a227], 0
je 0x658bee
push 0
push dword [0x68a250]
push 0x65aa40
lea edx, [ebp - 0x1200]
mov eax, dword [ebp - 0x1c]
call fcn.00429384
push dword [ebp - 0x1200]
push 0x65bc4c
lea eax, [ebp - 0x11fc]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x11fc]
call fcn.0040bffc
push eax
lea edx, [ebp - 0x1204]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1204]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1208]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1208]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x658c1b
cmp byte [ebp - 0x18], 3
jne 0x658c40
mov eax, 0x65bc6c
call fcn.00643738
test al, al
jne 0x6595c8
mov eax, dword [ebp - 0x1c]
call fcn.00656734
jmp 0x6595c8
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x658c4c
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x658c8b
lea edx, [ebp - 0x1210]
mov eax, dword [ebp - 0x1c]
call fcn.00429260
mov eax, dword [ebp - 0x1210]
lea edx, [ebp - 0x120c]
call fcn.00643830
mov eax, dword [ebp - 0x120c]
mov dl, 1
call fcn.00428ad4
test al, al
jne 0x659109
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x1214]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1214]
mov edx, 0x65bc9c
call fcn.0040c398
jne 0x658d1e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x658ce0
mov eax, dword [ebp - 0xb4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xb4]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65aa40
call fcn.0040c52c
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x658d4e
mov eax, dword [ebp - 0xc0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc0]
sub edx, eax
jl 0x6590ff
inc edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x6590f0
lea eax, [ebp - 0x121c]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x121c]
lea edx, [ebp - 0x1218]
call fcn.00643830
mov eax, dword [ebp - 0x1218]
mov dl, 1
call fcn.00428ad4
test al, al
jne 0x6590f0
xor edx, edx
push ebp
push 0x658e47
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1224]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov eax, dword [ebp - 0x1224]
lea edx, [ebp - 0x1220]
call fcn.00643830
mov eax, dword [ebp - 0x1220]
call fcn.004071c4
call fcn.00407168
cmp byte [0x68a221], 0
je 0x658e3a
cmp byte [ebp - 0x17], 0
je 0x658e3a
lea eax, [ebp - 0x1228]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c3d0
mov edx, dword [ebp - 0x1228]
mov eax, 0x65bcb0
call fcn.0064888c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6590f0
inc dword [ebp - 0x64]
dec dword [ebp - 0x90]
jne 0x658d6c
cmp byte [ebp - 0x75], 0
jne 0x6595c8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x659115
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x6595c8
lea edx, [ebp - 0x1268]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1268]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x6592d0
lea edx, [ebp - 0x1270]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1270]
lea edx, [ebp - 0x126c]
call fcn.00427078
mov eax, dword [ebp - 0x126c]
mov edx, 0x65bdc0
call fcn.0040c398
jne 0x6591da
mov eax, dword [ebp - 0x1c]
call fcn.0064363c
test al, al
je 0x6591da
push 0
push 0
push 0x65bdd8
lea edx, [ebp - 0x1278]
mov eax, dword [ebp - 0x1c]
call fcn.00429384
push dword [ebp - 0x1278]
push 0x65be0c
lea eax, [ebp - 0x1274]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x1274]
call fcn.0040bffc
push eax
push 0x65be14
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x127c]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x127c]
mov dl, 1
call fcn.00428d34
test eax, 1
jle 0x65923f
xor eax, eax
push ebp
push 0x659235
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1280]
mov cl, 1
mov edx, 0x80
call fcn.00428dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65923f
lea edx, [ebp - 0x1288]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1288]
lea edx, [ebp - 0x1284]
call fcn.00427078
mov eax, dword [ebp - 0x1284]
mov edx, 0x65be30
call fcn.0040c398
je 0x6592a1
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x1c]
call fcn.004293e0
mov eax, dword [ebp - 0x1290]
lea edx, [ebp - 0x128c]
call fcn.00427078
mov eax, dword [ebp - 0x128c]
mov edx, 0x65be48
call fcn.0040c398
jne 0x6592d0
lea edx, [ebp - 0x1294]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1294]
call fcn.00656634
push 0x12c
call sub.kernel32.dll_Sleep
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
mov byte [ebp - 0x76], 0
lea edx, [ebp - 0x1298]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x1298]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x65932e
xor eax, eax
push ebp
push 0x659324
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x129c]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x129c]
call fcn.00429000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65932e
xor eax, eax
push ebp
push 0x65938e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
movzx eax, byte [ebp - 0x7a]
push eax
movzx eax, byte [ebp - 0x79]
push eax
movzx eax, byte [ebp - 0x7b]
push eax
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x1c]
call fcn.00643830
mov eax, dword [ebp - 0x12a0]
push eax
lea edx, [ebp - 0x12a4]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov edx, dword [ebp - 0x12a4]
mov eax, dword [0x68a1ec]
pop ecx
call fcn.006270c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65957b
cmp byte [ebp - 0x76], 0
jne 0x6592d0
cmp byte [ebp - 0x7a], 0
je 0x659593
mov eax, dword [ebp - 0x1c]
call fcn.00656d94
cmp byte [0x68a221], 0
je 0x6595af
cmp byte [ebp - 0x17], 0
je 0x6595af
mov edx, dword [ebp - 0x1c]
mov eax, 0x65aa94
call fcn.0064888c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
cmp dword [ebp - 0x6c], 0x32
jge 0x6595c8
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x658614
xor eax, eax
push ebp
push 0x659603
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a1ec]
call fcn.006260f0
mov eax, dword [0x68a1ec]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65960d
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x63
call fcn.0058efec
push 0x65bfd8
lea eax, [ebp - 0x12c8]
push eax
mov ecx, 0x65c00c
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
mov ecx, dword [ebp - 4]
mov edx, 0x65ae94
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659739
push 0x65c020
lea eax, [ebp - 0x12cc]
push eax
mov ecx, 0x65c058
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12cc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659729
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12d0]
push eax
lea ecx, [ebp - 0x12d4]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12d4]
mov edx, 0x65ae94
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12d0]
mov eax, dword [ebp - 0x58]
call fcn.0064b128
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x6596e1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
cmp byte [0x68a221], 0
je 0x6597a5
cmp byte [0x68a22f], 0
jne 0x6597a5
lea edx, [ebp - 0x12dc]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x12dc]
push 0x65aa40
lea ecx, [ebp - 0x12e0]
mov edx, 0x65aa50
mov eax, dword [0x68a27c]
call fcn.00429140
push dword [ebp - 0x12e0]
lea eax, [ebp - 0x12d8]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x12d8]
mov eax, 0x65aa94
call fcn.0064888c
push 0
mov ecx, 0x65acbc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a2a4
push 0
mov ecx, 0x65c068
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x6598f4
push 0x65b770
lea eax, [ebp - 0x12e4]
push eax
mov ecx, 0x65b7a4
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
cmp byte [0x68a222], 0
je 0x659845
mov word [ebp - 0x86], 0
jmp 0x65984e
mov word [ebp - 0x86], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65c08c
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x65987b
lea eax, [ebp - 0xc]
mov edx, 0x65c0bc
call fcn.0040b89c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x65989e
mov eax, dword [ebp - 0xc4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jle 0x6598f4
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x6598f4
mov word [ebp - 0x86], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x6598dc
mov eax, dword [ebp - 0xc8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc8]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c3d0
push 0
mov ecx, 0x65c068
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x659919
dec eax
je 0x659a35
jmp 0x659bee
push 0
lea eax, [ebp - 0x12ec]
push eax
mov ecx, 0x65c0f4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x12ec]
lea eax, [ebp - 0x12e8]
mov edx, 0x65c11c
call fcn.0040c260
mov eax, dword [ebp - 0x12e8]
lea edx, [ebp - 8]
call fcn.00646978
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00428a3c
test al, al
jne 0x659976
lea eax, [ebp - 8]
mov edx, dword [0x68a270]
call fcn.0040b89c
lea edx, [ebp - 0x12f0]
mov eax, dword [ebp - 8]
call fcn.00643830
mov eax, dword [ebp - 0x12f0]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x659a29
lea edx, [ebp - 0x12f4]
mov eax, 0x65c144
call fcn.00646978
mov eax, dword [ebp - 0x12f4]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x659a29
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65c180
push dword [ebp - 8]
push 0x65c194
push dword [ebp - 0xc]
lea eax, [ebp - 0x12fc]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x12fc]
lea edx, [ebp - 0x12f8]
call fcn.00646978
mov eax, dword [ebp - 0x12f8]
push eax
lea edx, [ebp - 0x1300]
mov eax, 0x65c144
call fcn.00646978
mov eax, dword [ebp - 0x1300]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fdb8
jmp 0x659bee
mov byte [0x68a228], 1
jmp 0x659bee
push 0
lea eax, [ebp - 0x1304]
push eax
mov ecx, 0x65c0f4
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1304]
lea edx, [ebp - 8]
call fcn.00646978
cmp dword [ebp - 8], 0
je 0x659be7
lea edx, [ebp - 0x1308]
mov eax, dword [ebp - 8]
call fcn.00656898
cmp dword [ebp - 0x1308], 0
je 0x659be7
lea edx, [ebp - 0x130c]
mov eax, 0x65c1a8
call fcn.00646978
mov eax, dword [ebp - 0x130c]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x659be7
push 1
push 1
push 0
push 0x65c1f0
push dword [ebp - 8]
push 0x65c208
lea edx, [ebp - 0x1318]
mov eax, dword [ebp - 8]
call fcn.00656898
push dword [ebp - 0x1318]
push 0x65c240
lea eax, [ebp - 0x1314]
mov edx, 5
call fcn.0040c2e8
mov eax, dword [ebp - 0x1314]
lea edx, [ebp - 0x1310]
call fcn.00646978
mov eax, dword [ebp - 0x1310]
push eax
lea edx, [ebp - 0x131c]
mov eax, 0x65c1a8
call fcn.00646978
mov eax, dword [ebp - 0x131c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fdb8
test al, al
je 0x659bde
mov eax, dword [0x68a25c]
mov edx, 0x65b8b0
call fcn.0040c398
je 0x659bd5
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 0x65c250
lea edx, [ebp - 0x1328]
mov eax, dword [ebp - 8]
call fcn.00656898
push dword [ebp - 0x1328]
push 0x65c194
push dword [ebp - 0xc]
lea eax, [ebp - 0x1324]
mov edx, 4
call fcn.0040c2e8
mov eax, dword [ebp - 0x1324]
lea edx, [ebp - 0x1320]
call fcn.00646978
mov eax, dword [ebp - 0x1320]
push eax
lea edx, [ebp - 0x132c]
mov eax, 0x65c144
call fcn.00646978
mov eax, dword [ebp - 0x132c]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b178
pop edx
pop ecx
call fcn.0064fdb8
test al, al
jne 0x659bee
mov byte [0x68a228], 1
jmp 0x659bee
mov byte [0x68a228], 1
jmp 0x659bee
mov byte [0x68a228], 1
jmp 0x659bee
mov byte [0x68a228], 1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c0]
cmp byte [eax + 0x69], 0
je 0x659cf8
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x659cf8
push 0x65c284
lea eax, [ebp - 0x1330]
push eax
mov ecx, 0x65c2c4
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1330]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
mov ecx, dword [ebp - 4]
mov edx, 0x65c2d4
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659ccc
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1334]
push eax
lea ecx, [ebp - 0x1338]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1338]
mov edx, 0x65c2d4
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1334]
call fcn.0064dec0
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659c87
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov ecx, dword [ebp - 4]
mov edx, 0x65c2f8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659de4
push 0x65c318
lea eax, [ebp - 0x133c]
push eax
mov ecx, 0x65c360
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x133c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x659dd4
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68a22b], 0
jne 0x659dd4
push 0
lea eax, [ebp - 0x1340]
push eax
lea ecx, [ebp - 0x1344]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1344]
mov edx, 0x65c2f8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1340]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
test al, al
je 0x659dd4
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659d7f
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, 0x68a280
call fcn.0040b464
mov edx, 0x65c370
mov eax, dword [0x68a214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x659e79
mov ecx, dword [ebp - 4]
mov edx, 0x65c370
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x659e79
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1348]
push eax
lea edx, [ebp - 0x134c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x134c]
mov edx, 0x65c370
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1348]
mov eax, dword [ebp - 0x58]
call fcn.0064d7f0
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659e34
push 0
mov ecx, 0x65b5e8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659ef3
push 0xffffffffffffffff
mov ecx, 0x65b614
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jne 0x659ef3
cmp byte [0x68a225], 0
je 0x659ec5
lea eax, [ebp - 8]
mov edx, 0x65c384
call fcn.0040b89c
jmp 0x659ed2
lea eax, [ebp - 8]
mov edx, 0x65c3b0
call fcn.0040b89c
lea eax, [ebp - 0x1350]
mov ecx, 0x65c3dc
mov edx, dword [ebp - 8]
call fcn.0040c260
mov edx, dword [ebp - 0x1350]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x4dc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x659f5e
cmp byte [0x68a225], 0
je 0x659f20
lea eax, [ebp - 8]
mov edx, 0x65c384
call fcn.0040b89c
jmp 0x659f2d
lea eax, [ebp - 8]
mov edx, 0x65c3b0
call fcn.0040b89c
push dword [ebp - 8]
push 0x65c4cc
push dword [0x68a258]
push 0x65c54c
lea eax, [ebp - 0x1354]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov ecx, dword [ebp - 4]
mov edx, 0x65c580
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x65a07a
push 0x65c318
lea eax, [ebp - 0x1358]
push eax
mov ecx, 0x65c360
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1358]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65a027
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x1360]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1360]
mov edx, 0x65c580
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x135c]
mov eax, dword [ebp - 0x58]
call fcn.0064ed4c
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659fdf
xor eax, eax
push ebp
push 0x65a060
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0x1388
push 2
push 0x65c59c
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a06a
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
push 0x65bfd8
lea eax, [ebp - 0x1364]
push eax
mov ecx, 0x65c00c
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1364]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
mov edx, 0x65c5c0
mov eax, dword [0x68a214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65a145
mov ecx, dword [ebp - 4]
mov edx, 0x65c5c0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65a145
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1368]
push eax
lea edx, [ebp - 0x136c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x136c]
mov edx, 0x65c5c0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1368]
mov eax, dword [ebp - 0x58]
call fcn.00651084
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65a100
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov edx, 0x65c5dc
mov eax, dword [0x68a214]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65a2a4
mov ecx, dword [ebp - 4]
mov edx, 0x65c5dc
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65a2a4
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1370]
push eax
lea edx, [ebp - 0x1374]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x1374]
mov edx, 0x65c5dc
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1370]
mov ax, 4
call fcn.0065331c
cmp byte [0x68a22d], 0
je 0x65a20a
mov byte [0x68a228], 1
cmp byte [0x68a220], 0
je 0x65a203
mov eax, dword [0x68a2cc]
push eax
call dword [0x68a2c8]
push ebp
call fcn.00656ed4
pop ecx
push 0
lea eax, [ebp - 0x1378]
push eax
lea edx, [ebp - 0x137c]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x137c]
mov edx, 0x65c5dc
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1378]
mov ax, 5
call fcn.0065331c
push 0x65bfd8
lea eax, [ebp - 0x1380]
push eax
mov ecx, 0x65c00c
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1380]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x45c]
xor edx, edx
call fcn.0055156c
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65a1a3
cmp dword [0x68a258], 0
je 0x65a421
lea edx, [ebp - 0x1384]
mov eax, dword [0x68a258]
call fcn.00643830
mov eax, dword [ebp - 0x1384]
mov dl, 1
call fcn.00428a3c
test al, al
je 0x65a421
push 0
mov ecx, 0x65c5fc
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a389
lea edx, [ebp - 0x1388]
mov eax, dword [0x68a258]
call fcn.00429384
mov ecx, dword [ebp - 0x1388]
lea eax, [ebp - 8]
mov edx, 0x65c628
call fcn.0040c260
push dword [ebp - 8]
push 0x65c6b8
push dword [0x68a258]
push 0x65c54c
lea eax, [ebp - 0x138c]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x138c]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
push dword [ebp - 8]
push 0x65c6e0
lea edx, [ebp - 0x1394]
mov eax, dword [0x68a258]
call fcn.00429260
push dword [ebp - 0x1394]
push 0x65c54c
lea eax, [ebp - 0x1390]
mov edx, 4
call fcn.0040c2e8
mov edx, dword [ebp - 0x1390]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
mov eax, 0x65c710
call fcn.00643738
test al, al
je 0x65a3d5
push 0x65c738
lea edx, [ebp - 0x139c]
mov eax, dword [0x68a258]
call fcn.00429384
push dword [ebp - 0x139c]
push 0x65c79c
lea eax, [ebp - 0x1398]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x1398]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
mov eax, 0x65c800
call fcn.00643738
test al, al
je 0x65a421
push 0x65c738
lea edx, [ebp - 0x13a4]
mov eax, dword [0x68a258]
call fcn.00429384
push dword [ebp - 0x13a4]
push 0x65c824
lea eax, [ebp - 0x13a0]
mov edx, 3
call fcn.0040c2e8
mov edx, dword [ebp - 0x13a0]
mov eax, dword [ebp - 0x58]
call fcn.0064c754
cmp byte [0x68a220], 0
je 0x65a458
xor eax, eax
push ebp
push 0x65a44e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a2cc]
push eax
call dword [0x68a2c8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a458
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x464]
mov edx, 0x64
call fcn.0058efec
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
push 0x65bfd8
lea eax, [ebp - 0x13a8]
push eax
mov ecx, 0x65c00c
mov edx, 0x65a9fc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x13a8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x460]
call fcn.0055156c
cmp byte [0x68a221], 0
je 0x65a4d3
push 0
mov ecx, 0x65c884
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a4d3
call fcn.00655554
xor eax, eax
push ebp
push 0x65a4fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a29c]
call fcn.00409674
mov eax, dword [ebp - 4]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a507
cmp byte [0x68a231], 0
je 0x65a549
lea edx, [ebp - 0x13ac]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x13ac]
call fcn.00656930
test al, al
jne 0x65a549
push 0
mov ecx, 0x65af80
mov edx, 0x65ac10
mov eax, dword [0x68a21c]
mov ebx, dword [eax]
call dword [ebx + 0x24]
xor eax, eax
push ebp
push 0x65a575
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68a21c]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x68a21c]
call fcn.00409674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a57f
cmp byte [0x68a221], 0
je 0x65a627
push 0
lea edx, [ebp - 0x13b8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
push dword [ebp - 0x13b8]
push 0x65aa40
lea ecx, [ebp - 0x13bc]
mov edx, 0x65aa50
mov eax, dword [0x68a27c]
call fcn.00429140
push dword [ebp - 0x13bc]
lea eax, [ebp - 0x13b4]
mov edx, 3
call fcn.0040c2e8
mov eax, dword [ebp - 0x13b4]
lea edx, [ebp - 0x13b0]
call fcn.00643830
mov eax, dword [ebp - 0x13b0]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13c0]
mov ecx, 0x65aa68
mov edx, dword [0x68a250]
call fcn.0040c260
mov eax, dword [ebp - 0x13c0]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65a627
mov byte [0x68a228], 1
cmp byte [0x68a221], 0
jne 0x65a702
push 0
mov ecx, 0x65ada0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a702
lea edx, [ebp - 0x13c8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13c8]
mov edx, 0x65c8ac
call fcn.0040c208
mov eax, dword [ebp - 0x13c8]
lea edx, [ebp - 0x13c4]
call fcn.00643830
mov eax, dword [ebp - 0x13c4]
mov dl, 1
call fcn.00428a3c
test al, al
jne 0x65a702
push 0
lea edx, [ebp - 0x13d0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13d0]
mov edx, 0x65c8ac
call fcn.0040c208
mov eax, dword [ebp - 0x13d0]
lea edx, [ebp - 0x13cc]
call fcn.00643830
mov eax, dword [ebp - 0x13cc]
call fcn.0040bffc
push eax
lea eax, [ebp - 0x13d4]
mov ecx, 0x65aa68
mov edx, dword [0x68a250]
call fcn.0040c260
mov eax, dword [ebp - 0x13d4]
call fcn.0040bffc
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x65ada0
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a7c0
push 0
mov ecx, 0x65b5e8
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a7c0
push 0xffffffffffffffff
mov ecx, 0x65b614
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x65a7c0
push 5
push 0
push 1
lea edx, [ebp - 0x13dc]
mov eax, dword [ebp - 0x60]
call fcn.00427d98
mov ecx, dword [ebp - 0x13dc]
lea eax, [ebp - 0x13d8]
mov edx, 0x65c8d4
call fcn.0040c260
mov eax, dword [ebp - 0x13d8]
push eax
lea edx, [ebp - 0x13e0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea eax, [ebp - 0x13e0]
mov edx, 0x65c900
call fcn.0040c208
mov edx, dword [ebp - 0x13e0]
xor eax, eax
pop ecx
call fcn.0064fdb8
mov byte [0x68a229], 1
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.00610390
cmp byte [0x68a222], 0
jne 0x65a7fd
push 0
mov ecx, 0x65c928
mov edx, 0x65a9a8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a7fd
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65a976
lea eax, [ebp - 0x13e0]
call fcn.0040b464
lea eax, [ebp - 0x13dc]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x13d0]
call fcn.0040b464
lea eax, [ebp - 0x13cc]
call fcn.0040b464
lea eax, [ebp - 0x13c8]
call fcn.0040b464
lea eax, [ebp - 0x13c4]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x13b8]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x13b0]
call fcn.0040b464
lea eax, [ebp - 0x13ac]
call fcn.0040b464
lea eax, [ebp - 0x13a8]
mov edx, 0x33
call fcn.0040b4c4
lea eax, [ebp - 0x12dc]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x12d4]
mov edx, 0x1f
call fcn.0040b4c4
lea eax, [ebp - 0x1254]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1258]
call fcn.0040b464
lea eax, [ebp - 0x124c]
mov edx, 0x29
call fcn.0040b4c4
lea eax, [ebp - 0x11a0]
mov edx, 0x16
call fcn.0040b4c4
lea eax, [ebp - 0x1148]
call fcn.0040b464
lea eax, [ebp - 0x1144]
mov edx, 0x18
call fcn.0040b4c4
lea eax, [ebp - 0x10e4]
call fcn.0040b464
lea eax, [ebp - 0x10e0]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x10d4]
call fcn.0040b464
lea eax, [ebp - 0x10d0]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x1c]
mov edx, dword [0x656e74]
call fcn.0040cb78
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040b4c4
lea eax, [ebp - 0x52]
mov edx, dword [0x61e870]
call fcn.0040cb78
lea eax, [ebp - 0x14]
call fcn.0040b464
pop eax
jmp eax