Function at 0x6562d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x6562dd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
call fcn.00409650
lea eax, [ebp - 0x20]
mov edx, dword [0x656230]
call fcn.0040a96c
mov ebx, 0x68b958
xor eax, eax
push ebp
push 0x6576e9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x657654
movzx eax, byte [0x6576fc]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x65770c
mov edx, 0x657720
mov eax, dword [ebp - 4]
call fcn.0042b81c
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 7
jne 0x657654
lea ecx, [ebp - 0x34]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x34]
mov ecx, 1
mov eax, 0x657734
call fcn.0040a710
test eax, eax
jle 0x656390
cmp byte [0x68b8e7], 0
jne 0x657654
lea ecx, [ebp - 0x38]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x38]
mov ecx, 1
mov eax, 0x657748
call fcn.0040a710
test eax, eax
jle 0x6563c2
cmp byte [0x68b8e7], 0
je 0x657654
lea ecx, [ebp - 0x40]
mov edx, 3
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00422824
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x18]
call fcn.00409994
mov eax, dword [ebp - 0x18]
mov edx, 0x65775c
call fcn.0040a4c8
jne 0x656403
lea eax, [ebp - 0x18]
mov edx, 0x6577a0
call fcn.00409994
mov eax, esi
dec ax
je 0x65641b
dec ax
je 0x656430
dec ax
je 0x656445
dec ax
je 0x65645a
jmp 0x65646d
mov eax, dword [ebp - 0x18]
mov edx, 0x6577dc
call fcn.0040a4c8
jne 0x657654
jmp 0x65646d
mov eax, dword [ebp - 0x18]
mov edx, 0x657810
call fcn.0040a4c8
jne 0x657654
jmp 0x65646d
mov eax, dword [ebp - 0x18]
mov edx, 0x657854
call fcn.0040a4c8
jne 0x657654
jmp 0x65646d
mov eax, dword [ebp - 0x18]
mov edx, 0x657890
call fcn.0040a4c8
jne 0x657654
push 0
mov ecx, 0x6578c4
mov edx, 0x6578e4
mov eax, dword [0x68b8d0]
mov edi, dword [eax]
call dword [edi + 0x14]
test al, al
je 0x6564d3
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00645f98
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x20]
lea ecx, [ebp - 0x50]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00645f98
mov ecx, dword [ebp - 0x4c]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, 0x6578fc
call fcn.00646680
test al, al
je 0x65652d
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00649348
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x20]
call fcn.00409994
lea ecx, [ebp - 0x60]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00649348
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x1c]
call fcn.00409994
jmp 0x6566fc
cmp si, 5
jne 0x6565da
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00422824
mov edx, dword [ebp - 0x64]
mov ecx, 1
mov eax, 0x657920
call fcn.0040a710
test eax, eax
jle 0x6565da
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x657938]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x657948
mov edx, 0x657964
mov eax, dword [ebp - 8]
call fcn.0042b81c
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 8]
call fcn.00649348
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 8]
call fcn.00409994
movzx eax, byte [0x657938]
push eax
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x657988
mov edx, 0x6579ac
mov eax, dword [ebp - 8]
call fcn.0042b81c
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x20]
call fcn.00409994
jmp 0x6565fc
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00649348
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x20]
call fcn.00409994
cmp si, 5
jne 0x6566cb
lea ecx, [ebp - 0x84]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00422824
mov edx, dword [ebp - 0x80]
mov ecx, 1
mov eax, 0x6579c8
call fcn.0040a710
test eax, eax
jle 0x6566cb
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x657938]
push eax
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x6579ec
mov edx, 0x657a08
mov eax, dword [ebp - 8]
call fcn.0042b81c
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 8]
call fcn.00649348
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 8]
call fcn.00409994
movzx eax, byte [0x657938]
push eax
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x657a2c
mov edx, 0x657a50
mov eax, dword [ebp - 8]
call fcn.0042b81c
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x1c]
call fcn.00409994
jmp 0x6566fc
lea ecx, [ebp - 0x98]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.00649348
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x1c]
call fcn.00409994
cmp si, 5
jne 0x6568ca
mov eax, dword [ebp - 0x18]
mov edx, 0x657a6c
call fcn.0040a4c8
jne 0x65679b
push dword [ebp - 0x20]
push 0x657aa4
push dword [ebp - 0x1c]
push 0x657ab8
lea ecx, [ebp - 0xa0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xa0]
push 0x657acc
lea ecx, [ebp - 0xa4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xa4]
push 0x657ae0
lea ecx, [ebp - 0xa8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xa8]
lea eax, [ebp - 0x9c]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x9c]
mov eax, 0x657af4
call fcn.0064b908
mov eax, dword [ebp - 0x18]
mov edx, 0x657b2c
call fcn.0040a4c8
jne 0x656830
push dword [ebp - 0x20]
push 0x657b64
push dword [ebp - 0x1c]
push 0x657b78
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xb0]
push 0x657b8c
lea ecx, [ebp - 0xb4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xb4]
push 0x657ba0
lea ecx, [ebp - 0xb8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xb8]
lea eax, [ebp - 0xac]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0xac]
mov eax, 0x657bb4
call fcn.0064b908
mov eax, dword [ebp - 0x18]
mov edx, 0x657be8
call fcn.0040a4c8
jne 0x657654
push dword [ebp - 0x20]
push 0x657c20
push dword [ebp - 0x1c]
push 0x657c34
lea ecx, [ebp - 0xc0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xc0]
push 0x657c48
lea ecx, [ebp - 0xc4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0xc4]
push 0x657c5c
lea ecx, [ebp - 0xc8]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0xc8]
lea eax, [ebp - 0xbc]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0xbc]
mov eax, 0x657c70
call fcn.0064b908
jmp 0x657654
lea ecx, [ebp - 0xd0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.00422824
mov ecx, dword [ebp - 0xcc]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
mov word [ebp - 0x14], 1
lea ecx, [ebp - 0xd4]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xd4]
mov edx, 0x657ca4
call fcn.0040a4c8
jne 0x656931
mov word [ebp - 0x14], 3
jmp 0x656987
lea ecx, [ebp - 0xd8]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xd8]
mov edx, 0x657cc4
call fcn.0040a4c8
jne 0x65695d
mov word [ebp - 0x14], 2
jmp 0x656987
lea ecx, [ebp - 0xdc]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xdc]
mov edx, 0x657ce4
call fcn.0040a4c8
jne 0x656987
mov word [ebp - 0x14], 0
lea ecx, [ebp - 0xe4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00422824
mov ecx, dword [ebp - 0xe0]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xe8]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xe8]
mov edx, 0x657cfc
call fcn.0040a4c8
je 0x656a08
lea ecx, [ebp - 0xec]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xec]
mov edx, 0x657d10
call fcn.0040a4c8
je 0x656a08
xor eax, eax
jmp 0x656a0a
mov al, 1
mov byte [ebp - 0x12], al
lea ecx, [ebp - 0xf4]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00422824
mov ecx, dword [ebp - 0xf0]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xf8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xf8]
mov edx, 0x657d20
call fcn.0040a4c8
je 0x656a8e
lea ecx, [ebp - 0xfc]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xfc]
mov edx, 0x657d34
call fcn.0040a4c8
je 0x656a8e
xor eax, eax
jmp 0x656a90
mov al, 1
mov byte [ebp - 0x11], al
mov byte [0x68b94c], 0
mov byte [0x68b94d], 0
mov esi, dword [ebp - 0x20]
mov eax, esi
test eax, eax
je 0x656aaf
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x656ea1
lea eax, [ebp - 0x104]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040a500
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.00422824
mov eax, dword [ebp - 0x100]
mov edx, 0x657d44
call fcn.0040a4c8
jne 0x656ea1
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x657d58
call fcn.0040a710
test eax, eax
jle 0x656ea1
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x657d68
call fcn.0040a710
test eax, eax
jle 0x656ea1
mov ebx, esi
test ebx, ebx
je 0x656b37
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x657d78
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
mov ebx, esi
test ebx, ebx
je 0x656b7e
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x657d88
call fcn.0040a710
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00649348
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xc]
call fcn.00649348
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0xc]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a4c8
jne 0x657654
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x656bf6
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jle 0x657654
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409994
lea eax, [ebp - 0x114]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.00422824
mov eax, dword [ebp - 0x110]
mov edx, 0x657d98
call fcn.0040a4c8
je 0x656cc2
lea eax, [ebp - 0x11c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00422824
mov eax, dword [ebp - 0x118]
mov edx, 0x657db0
call fcn.0040a4c8
je 0x656cc2
lea eax, [ebp - 0x124]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00422824
mov eax, dword [ebp - 0x120]
mov edx, 0x657dc8
call fcn.0040a4c8
jne 0x657654
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x657de0
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.0040a548
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x656cef
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x10]
call fcn.00649348
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0x10]
call fcn.00409994
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00422824
mov eax, dword [ebp - 0x12c]
mov edx, 0x657df0
call fcn.0040a4c8
jne 0x656d94
cmp byte [0x68b8de], 0
jne 0x656d94
push 0x40040
lea edx, [ebp - 0x134]
mov eax, dword [0x68b898]
call fcn.005418d0
mov eax, dword [ebp - 0x134]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x24]
call fcn.0054aaf4
push eax
call sub.user32.dll_MessageBoxW
lea eax, [ebp - 0x13c]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00422824
mov eax, dword [ebp - 0x138]
mov edx, 0x657e00
call fcn.0040a4c8
jne 0x656e16
cmp dword [ebp - 0x10], 0
je 0x656e0f
cmp byte [0x68b8de], 0
jne 0x656e0f
push 0x40030
lea edx, [ebp - 0x140]
mov eax, dword [0x68b898]
call fcn.005418d0
mov eax, dword [ebp - 0x140]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x24]
call fcn.0054aaf4
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68b94c], 1
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00422824
mov eax, dword [ebp - 0x144]
mov edx, 0x657e10
call fcn.0040a4c8
jne 0x657654
cmp dword [ebp - 0x10], 0
je 0x656e95
cmp byte [0x68b8de], 0
jne 0x656e95
push 0x40030
lea edx, [ebp - 0x14c]
mov eax, dword [0x68b898]
call fcn.005418d0
mov eax, dword [ebp - 0x14c]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x24]
call fcn.0054aaf4
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x68b94d], 1
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x657e20
jne 0x656eaf
mov al, 1
jmp 0x656ed4
cmp dword [ebp - 0x20], 0
je 0x656ebe
mov eax, 0x657e3c
test eax, eax
jne 0x656ec2
xor eax, eax
jmp 0x656ed4
mov edx, 0x657e58
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x657005
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x657e74
call fcn.0040a710
test eax, eax
jle 0x656f1e
movzx eax, byte [0x6576fc]
push eax
lea eax, [ebp - 0x150]
push eax
xor ecx, ecx
mov edx, 0x657e84
mov eax, dword [ebp - 0x1c]
call fcn.0042b81c
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241f0
test al, al
je 0x657654
mov byte [ebp - 0x29], 0
mov dl, 1
mov eax, dword [0x48fe5c]
call fcn.004b380c
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x656fc2
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x154]
mov edx, ebx
mov eax, dword [ebp - 0x28]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x154]
mov ecx, 1
mov eax, 0x657e94
call fcn.0040a710
test eax, eax
jle 0x656fbe
mov byte [ebp - 0x29], 1
lea ecx, [ebp - 0x15c]
mov edx, ebx
mov eax, dword [ebp - 0x28]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00649348
mov ecx, dword [ebp - 0x158]
mov edx, ebx
mov eax, dword [ebp - 0x28]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x656f60
cmp byte [ebp - 0x29], 0
je 0x656ff8
xor eax, eax
push ebp
push 0x656fee
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x656ff8
mov eax, dword [ebp - 0x28]
call fcn.004078f0
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x657ea4
jne 0x657013
mov al, 1
jmp 0x657038
cmp dword [ebp - 0x20], 0
je 0x657022
mov eax, 0x657ecc
test eax, eax
jne 0x657026
xor eax, eax
jmp 0x657038
mov edx, 0x657ef4
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x6570b1
cmp dword [ebp - 0x1c], 0
jne 0x657050
lea eax, [ebp - 0x1c]
mov edx, dword [0x68b92c]
call fcn.00409994
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x657f1c
call fcn.0040a710
test eax, eax
jle 0x657092
movzx eax, byte [0x6576fc]
push eax
lea eax, [ebp - 0x160]
push eax
xor ecx, ecx
mov edx, 0x657f2c
mov eax, dword [ebp - 0x1c]
call fcn.0042b81c
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.00424288
test al, al
je 0x657654
mov eax, dword [ebp - 0x1c]
call fcn.00424e00
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x657f3c
jne 0x6570bf
mov al, 1
jmp 0x6570e4
cmp dword [ebp - 0x20], 0
je 0x6570ce
mov eax, 0x657f5c
test eax, eax
jne 0x6570d2
xor eax, eax
jmp 0x6570e4
mov edx, 0x657f7c
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x657161
cmp byte [0x68b8e7], 0
je 0x657161
xor eax, eax
push ebp
push 0x657152
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x68b978], eax
push 0x657f90
push 0x657fd0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x68b970], eax
push 0x657fec
push 0x657fd0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x68b974], eax
push 0x68b978
call dword [0x68b970]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x658034
jne 0x65716f
mov al, 1
jmp 0x657194
cmp dword [ebp - 0x20], 0
je 0x65717e
mov eax, 0x658050
test eax, eax
jne 0x657182
xor eax, eax
jmp 0x657194
mov edx, 0x65806c
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x6571d7
cmp byte [0x68b8e7], 0
je 0x6571d7
xor eax, eax
push ebp
push 0x6571c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b978]
push eax
call dword [0x68b974]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x658088
jne 0x6571e5
mov al, 1
jmp 0x65720a
cmp dword [ebp - 0x20], 0
je 0x6571f4
mov eax, 0x6580b0
test eax, eax
jne 0x6571f8
xor eax, eax
jmp 0x65720a
mov edx, 0x6580d8
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x6572bb
mov edx, 0x658100
mov eax, dword [0x68b8d0]
call fcn.0050947c
test al, al
je 0x6572bb
mov eax, dword [0x68b898]
mov eax, dword [eax + 0x3e0]
mov ecx, dword [eax + 0x2a0]
mov edx, 0x658120
mov eax, dword [0x68b8d0]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x68b898]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x2a0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
mov eax, dword [0x68b950]
mov edx, dword [eax]
call dword [edx + 0x48]
mov esi, ebx
dec esi
test esi, esi
jl 0x6572b1
inc esi
xor ebx, ebx
push 0
lea eax, [ebp - 0x164]
push eax
lea edx, [ebp - 0x168]
mov eax, ebx
call fcn.004235b4
mov ecx, dword [ebp - 0x168]
mov edx, 0x658140
mov eax, dword [0x68b8d0]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 0x164]
mov dl, 1
call fcn.0064be24
inc ebx
dec esi
jne 0x657275
call fcn.00654d84
jmp 0x657654
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6572c7
sub eax, 4
mov eax, dword [eax]
cmp eax, 7
jle 0x6573e5
lea eax, [ebp - 0x16c]
push eax
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 0x20]
call fcn.00422824
mov eax, dword [ebp - 0x170]
mov ecx, 6
mov edx, 1
call fcn.0040a500
mov eax, dword [ebp - 0x16c]
mov edx, 0x658160
call fcn.0040a4c8
jne 0x6573e5
cmp dword [ebp - 0x1c], 0
je 0x6573e5
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.00409994
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.0040a548
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x657345
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
cmp word [ecx + eax*2 - 2], 0x29
jne 0x657369
mov eax, edx
test eax, eax
je 0x65735b
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 8]
mov ecx, 1
xchg edx, eax
call fcn.0040a548
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 8]
call fcn.00649348
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 8]
call fcn.00409994
push 0x40024
lea edx, [ebp - 0x178]
mov eax, dword [0x68b898]
call fcn.005418d0
mov eax, dword [ebp - 0x178]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 8]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x24]
call fcn.0054aaf4
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x657654
push 0
push 0
mov eax, dword [0x68b898]
call fcn.0054aaf4
movzx ecx, byte [ebp - 0x12]
mov edx, dword [ebp - 0x1c]
call fcn.006547b4
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x65817c
jne 0x6573f3
mov al, 1
jmp 0x657418
cmp dword [ebp - 0x20], 0
je 0x657402
mov eax, 0x6581b0
test eax, eax
jne 0x657406
xor eax, eax
jmp 0x657418
mov edx, 0x6581e4
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x657431
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x658218
jne 0x65743f
mov al, 1
jmp 0x657464
cmp dword [ebp - 0x20], 0
je 0x65744e
mov eax, 0x658250
test eax, eax
jne 0x657452
xor eax, eax
jmp 0x657464
mov edx, 0x658288
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x65747a
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x6582c0
jne 0x657488
mov al, 1
jmp 0x6574ad
cmp dword [ebp - 0x20], 0
je 0x657497
mov eax, 0x6582dc
test eax, eax
jne 0x65749b
xor eax, eax
jmp 0x6574ad
mov edx, 0x6582f8
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x6574dc
mov eax, dword [ebp - 0x1c]
call fcn.0040a13c
push eax
call sub.gdi32.dll_AddFontResourceW
test eax, eax
je 0x657654
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x658314
jne 0x6574ea
mov al, 1
jmp 0x65750f
cmp dword [ebp - 0x20], 0
je 0x6574f9
mov eax, 0x658334
test eax, eax
jne 0x6574fd
xor eax, eax
jmp 0x65750f
mov edx, 0x658354
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x65753e
mov eax, dword [ebp - 0x1c]
call fcn.0040a13c
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x657654
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x658374
jne 0x65754c
mov al, 1
jmp 0x657571
cmp dword [ebp - 0x20], 0
je 0x65755b
mov eax, 0x65839c
test eax, eax
jne 0x65755f
xor eax, eax
jmp 0x657571
mov edx, 0x6583c4
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x65758a
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageW
jmp 0x657654
mov eax, dword [ebp - 0x20]
cmp eax, 0x6583ec
jne 0x657598
mov al, 1
jmp 0x6575bd
cmp dword [ebp - 0x20], 0
je 0x6575a7
mov eax, 0x65841c
test eax, eax
jne 0x6575ab
xor eax, eax
jmp 0x6575bd
mov edx, 0x65844c
mov eax, dword [ebp - 0x20]
call fcn.004229c4
test eax, eax
sete al
test al, al
je 0x657601
xor eax, eax
push ebp
push 0x6575f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1388
push 2
push 0x658470
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x657654
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.004241f0
test al, al
je 0x65762d
movzx eax, word [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.00652e8c
jmp 0x657648
movzx eax, word [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040a13c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x685578]
mov eax, dword [eax]
call fcn.00612610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6576f3
lea eax, [ebp - 0x178]
call fcn.0040956c
lea eax, [ebp - 0x174]
mov edx, 0xa
call fcn.004095cc
lea eax, [ebp - 0x14c]
call fcn.0040956c
lea eax, [ebp - 0x148]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x140]
call fcn.0040956c
lea eax, [ebp - 0x13c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x134]
call fcn.0040956c
lea eax, [ebp - 0x130]
mov edx, 0x41
call fcn.004095cc
lea eax, [ebp - 0x20]
mov edx, dword [0x656230]
call fcn.0040aa44
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004095cc
ret