Function at 0x5eb890
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x6d8
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x2e0], 0
mov qword [rbp + 0x2d8], 0
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2b8], 0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x310], 0
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x330], 0
mov qword [rbp + 0x328], 0
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x370], 0
mov qword [rbp + 0x368], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x350], 0
mov qword [rbp + 0x3a0], 0
mov qword [rbp + 0x398], 0
mov qword [rbp + 0x390], 0
mov qword [rbp + 0x388], 0
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x380], 0
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3c0], 0
mov qword [rbp + 0x3b8], 0
mov qword [rbp + 0x3a8], 0
mov qword [rbp + 0x3b0], 0
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3e8], 0
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x420], 0
mov qword [rbp + 0x418], 0
mov qword [rbp + 0x410], 0
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x428], 0
mov qword [rbp + 0x448], 0
mov qword [rbp + 0x440], 0
mov qword [rbp + 0x438], 0
mov qword [rbp + 0x430], 0
mov qword [rbp + 0x480], 0
mov qword [rbp + 0x458], 0
mov qword [rbp + 0x478], 0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x468], 0
mov qword [rbp + 0x460], 0
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x488], 0
mov qword [rbp + 0x490], 0
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4c0], 0
mov qword [rbp + 0x4f8], 0
mov qword [rbp + 0x4f0], 0
mov qword [rbp + 0x610], 0
mov qword [rbp + 0x608], 0
mov qword [rbp + 0x600], 0
mov qword [rbp + 0x620], 0
mov qword [rbp + 0x618], 0
mov qword [rbp + 0x638], 0
mov qword [rbp + 0x630], 0
mov qword [rbp + 0x628], 0
mov qword [rbp + 0x660], 0
mov qword [rbp + 0x658], 0
mov qword [rbp + 0x648], 0
mov qword [rbp + 0x640], 0
mov qword [rbp + 0x650], 0
mov qword [rbp + 0x668], 0
mov qword [rbp + 0x670], 0
mov qword [rbp + 0x6b8], 0
mov qword [rbp + 0x6b0], 0
mov qword [rbp + 0x678], rbp
nop
nop
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8ac8], rax
call fcn.005e7c60
cmp eax, dword [0x006931b4]
jle 0x5ebf96
mov dword [0x006931b4], 0x26
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8a80], rax
mov eax, dword [0x006942a0]
mov dword [0x006940cc], eax
mov eax, dword [0x006942a0]
mov dword [0x006940cc], eax
mov eax, dword [0x00695bb4]
cmp eax, dword [0x00695d8c]
je 0x5ebfdd
mov eax, dword [0x00695bb4]
mov dword [0x00695d8c], eax
mov eax, dword [0x006933fc]
add eax, 1
cmp dword [0x006933fc], eax
jne 0x5ec02e
mov eax, dword [0x0069394c]
test eax, eax
jge 0x5ebffd
call fcn.0040afc0
mov ecx, dword [0x00695840]
test ecx, ecx
jge 0x5ec00c
call fcn.0040afc0
mov edx, dword [0x00695938]
test edx, edx
jge 0x5ec01b
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00695850]
add eax, dword [0x00695948]
mov ecx, dword [0x00696118]
add ecx, dword [0x006961ac]
cmp eax, ecx
jle 0x5ec056
mov eax, dword [0x006961ac]
mov dword [0x00695850], eax
mov eax, dword [0x00696cbc]
add eax, dword [0x00693278]
mov ecx, dword [0x0069339c]
add ecx, dword [0x006934d0]
cmp eax, ecx
jle 0x5ec07c
mov dword [0x00696cbc], 0x12d
mov dword [0x00696e7c], 0x302
mov eax, dword [0x00696e7c]
sub eax, 0x194
mov dword [0x006932d0], eax
mov dword [0x00696e7c], 0x302
mov eax, dword [0x00696e7c]
sub eax, 0x194
mov dword [0x006932d0], eax
mov eax, dword [0x00695c10]
cmp eax, dword [0x0069615c]
je 0x5ec0ce
mov eax, dword [0x00695c10]
mov dword [0x0069615c], eax
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8ad0], rax
mov eax, dword [0x00695850]
mov dword [0x0069428c], eax
mov eax, dword [0x006933c4]
add eax, 1
cmp dword [0x006933c4], eax
jne 0x5ec116
mov eax, dword [0x006962c4]
test eax, eax
jge 0x5ec10f
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006933f4]
add eax, 1
cmp dword [0x006933f4], eax
jne 0x5ec167
mov eax, dword [0x006940e8]
test eax, eax
jge 0x5ec136
call fcn.0040afc0
mov ecx, dword [0x00695934]
test ecx, ecx
jge 0x5ec145
call fcn.0040afc0
mov edx, dword [0x00696150]
test edx, edx
jge 0x5ec154
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8ad8], rax
mov dword [0x006932a8], 0x2f2
mov eax, dword [0x006932a8]
sub eax, 0x19b
mov dword [0x00693414], eax
mov eax, dword [0x00696ca8]
mov dword [0x006965d8], eax
call fcn.005da060
mov dword [0x0069328c], 0x323
mov eax, dword [0x0069328c]
sub eax, 0x1b3
mov dword [0x006933f8], eax
mov dword [0x0069328c], 0x323
mov eax, dword [0x0069328c]
sub eax, 0x1b3
mov dword [0x006933f8], eax
mov eax, dword [0x00696180]
cmp eax, dword [0x00696570]
je 0x5ec1fb
mov eax, dword [0x00696180]
mov dword [0x00696570], eax
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8af8], rax
mov eax, dword [0x00696cdc]
add eax, dword [0x00693298]
mov ecx, dword [0x006933bc]
add ecx, dword [0x006934f0]
cmp eax, ecx
jle 0x5ec236
mov dword [0x00696cdc], 0xea
mov byte [rbp + 0x69f], 1
mov eax, dword [0x006933b4]
add eax, 1
cmp dword [0x006933b4], eax
jne 0x5ec2bb
mov eax, dword [0x00696ab0]
test eax, eax
jge 0x5ec25d
call fcn.0040afc0
mov ecx, dword [0x00693928]
test ecx, ecx
jge 0x5ec26c
call fcn.0040afc0
mov edx, dword [0x0069429c]
test edx, edx
jge 0x5ec27b
call fcn.0040afc0
mov r8d, dword [0x006958c8]
test r8d, r8d
jge 0x5ec28c
call fcn.0040afc0
mov r9d, dword [0x00695bdc]
test r9d, r9d
jge 0x5ec29d
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x0069592c]
add eax, dword [0x00695bf8]
mov ecx, dword [0x00696190]
add ecx, dword [0x006965cc]
cmp eax, ecx
jle 0x5ec2e3
mov eax, dword [0x006965cc]
mov dword [0x0069592c], eax
cmp byte [rbp + 0x69f], 0
je 0x5ec499
mov eax, dword [0x00695810]
add eax, dword [0x00695908]
mov ecx, dword [0x00695bd4]
add ecx, dword [0x0069616c]
cmp eax, ecx
jle 0x5ec311
call fcn.004096f0
mov eax, dword [0x006933cc]
add eax, 1
cmp dword [0x006933cc], eax
jne 0x5ec379
mov eax, dword [0x006962e4]
test eax, eax
jge 0x5ec331
call fcn.0040afc0
mov ecx, dword [0x00696e88]
test ecx, ecx
jge 0x5ec340
call fcn.0040afc0
mov edx, dword [0x006933b8]
test edx, edx
jge 0x5ec34f
call fcn.0040afc0
mov r8d, dword [0x00693534]
test r8d, r8d
jge 0x5ec360
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov dword [0x006931dc], 0x303
mov eax, dword [0x006931dc]
sub eax, 0x1a3
mov dword [0x006933ac], eax
mov eax, dword [0x00696320]
add eax, dword [0x00696a74]
mov ecx, dword [0x00695be0]
add ecx, dword [0x00696130]
cmp ecx, eax
jle 0x5ec3bd
mov ecx, dword [0x00696a74]
mov dword [0x00695be0], ecx
mov ecx, dword [0x00695be0]
add ecx, dword [0x00696130]
cmp ecx, eax
jle 0x5ec3d9
mov eax, dword [0x00696a74]
mov dword [0x00695be0], eax
mov eax, dword [0x006962e8]
cmp eax, dword [0x006965c0]
je 0x5ec3f3
mov eax, dword [0x006962e8]
mov dword [0x006965c0], eax
mov eax, dword [0x00695898]
mov dword [0x006942d0], eax
mov eax, dword [0x00693564]
sub eax, dword [0x00693430]
mov dword [0x00693430], eax
mov dword [rbp + 0x6ac], 0
lea rax, [0x006922ec]
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
xor byte [rax], 0x2d
add dword [rbp + 0x6ac], 1
add qword [rbp + 0x688], 1
cmp dword [rbp + 0x6ac], 0x94
jne 0x5ec429
nop
mov eax, dword [0x006965ec]
mov dword [0x00696310], eax
mov dword [rbp + 0x6ac], 0
lea rax, [0x00692380]
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
xor byte [rax], 0x2d
add dword [rbp + 0x6ac], 1
add qword [rbp + 0x688], 1
cmp dword [rbp + 0x6ac], 0x94
jne 0x5ec473
nop
mov eax, dword [0x00695820]
mov dword [0x006942a8], eax
mov eax, dword [0x00695928]
add eax, dword [0x00695d88]
mov ecx, dword [0x006962ec]
add ecx, dword [0x00696898]
cmp eax, ecx
jle 0x5ec4cd
mov eax, dword [0x00696898]
mov dword [0x00695928], eax
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8a98], rax
mov eax, dword [0x00693300]
add eax, 1
cmp dword [0x00693300], eax
jne 0x5ec509
mov eax, dword [0x00693528]
test eax, eax
jge 0x5ec502
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006942b8]
mov dword [0x006940e0], eax
mov eax, dword [0x006934bc]
add eax, dword [0x00693550]
mov ecx, dword [0x006940b0]
add ecx, dword [0x00694288]
cmp eax, ecx
jle 0x5ec53b
mov dword [0x006934bc], 0xe
mov eax, dword [0x00695bc0]
add eax, dword [0x00695d98]
mov ecx, dword [0x00696300]
add ecx, dword [0x006968ac]
cmp eax, ecx
jle 0x5ec563
mov eax, dword [0x006968ac]
mov dword [0x00695bc0], eax
mov eax, dword [0x0069411c]
mov dword [0x0069397c], eax
mov dword [0x006931e0], 0x304
mov eax, dword [0x006931e0]
sub eax, 0x1a4
mov dword [0x006933b0], eax
mov eax, dword [0x006931f0]
mov dword [0x00696c94], eax
mov eax, dword [0x00696190]
add eax, dword [0x006965cc]
mov ecx, dword [0x0069592c]
add ecx, dword [0x00695bf8]
cmp ecx, eax
jle 0x5ec5bf
mov ecx, dword [0x006965cc]
mov dword [0x0069592c], ecx
mov ecx, dword [0x0069592c]
add ecx, dword [0x00695bf8]
cmp ecx, eax
jle 0x5ec5db
mov eax, dword [0x006965cc]
mov dword [0x0069592c], eax
mov eax, dword [0x00695bec]
cmp eax, dword [0x00696184]
je 0x5ec5f5
mov eax, dword [0x00695bec]
mov dword [0x00696184], eax
mov rcx, qword [0x006a8a98]
lea rdx, [0x006922ec]
mov r8d, 0x94
call fcn.004fbd70
call fcn.005e6b80
mov eax, dword [0x00695804]
mov dword [0x006940fc], eax
mov eax, dword [0x006932ec]
add eax, 1
cmp dword [0x006932ec], eax
jne 0x5ec69e
mov eax, dword [0x006940d4]
test eax, eax
jge 0x5ec640
call fcn.0040afc0
mov ecx, dword [0x00695870]
test ecx, ecx
jge 0x5ec64f
call fcn.0040afc0
mov edx, dword [0x00695be8]
test edx, edx
jge 0x5ec65e
call fcn.0040afc0
mov r8d, dword [0x00696180]
test r8d, r8d
jge 0x5ec66f
call fcn.0040afc0
mov r9d, dword [0x006965b8]
test r9d, r9d
jge 0x5ec680
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x0069586c]
add eax, dword [0x00695918]
mov ecx, dword [0x00695d78]
add ecx, dword [0x006962dc]
cmp eax, ecx
jle 0x5ec6bf
call fcn.004096f0
mov eax, dword [0x006965d0]
mov dword [0x00696198], eax
mov eax, dword [0x00693410]
add eax, 1
cmp dword [0x00693410], eax
jne 0x5ec6f2
mov eax, dword [0x00696e54]
test eax, eax
jge 0x5ec6eb
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov dword [0x00693200], 0x311
mov eax, dword [0x00693200]
sub eax, 0x1aa
mov dword [0x006933cc], eax
mov dword [0x00693200], 0x311
mov eax, dword [0x00693200]
sub eax, 0x1aa
mov dword [0x006933cc], eax
mov eax, dword [0x00695bfc]
cmp eax, dword [0x00696194]
je 0x5ec744
mov eax, dword [0x00695bfc]
mov dword [0x00696194], eax
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [0x006a8aa0], rax
call fcn.005e9bb0
cmp eax, dword [0x0069320c]
jle 0x5ec770
mov dword [0x0069320c], 0x3d
mov eax, dword [0x00696e84]
add eax, dword [0x006932d8]
mov ecx, dword [0x006933fc]
add ecx, dword [0x00693530]
cmp eax, ecx
jle 0x5ec796
mov dword [0x00696e84], 0x113
mov eax, dword [0x006934e4]
add eax, 1
cmp dword [0x006934e4], eax
jne 0x5ec7fe
mov eax, dword [0x00696c90]
test eax, eax
jge 0x5ec7b6
call fcn.0040afc0
mov ecx, dword [0x006932e0]
test ecx, ecx
jge 0x5ec7c5
call fcn.0040afc0
mov edx, dword [0x006934ec]
test edx, edx
jge 0x5ec7d4
call fcn.0040afc0
mov r8d, dword [0x00694098]
test r8d, r8d
jge 0x5ec7e5
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x00695890]
mov dword [0x006942cc], eax
call fcn.005e9c80
cmp eax, dword [0x00693284]
jle 0x5ec821
mov dword [0x00693284], 0x55
call fcn.005ea870
cmp eax, dword [0x0069328c]
jle 0x5ec838
mov dword [0x0069328c], 0x57
mov eax, dword [0x006932a4]
mov dword [0x00696e50], eax
mov eax, dword [0x006931b8]
add eax, dword [0x006932f4]
mov ecx, dword [0x006934b8]
add ecx, dword [0x0069354c]
cmp eax, ecx
jle 0x5ec86a
mov dword [0x006931b8], 0xe6
mov rcx, qword [0x006a8aa0]
lea rdx, [0x00692380]
mov r8d, 0x94
call fcn.004fbd70
mov eax, dword [0x006933bc]
add eax, 1
cmp dword [0x006933bc], eax
jne 0x5ec8d5
mov eax, dword [0x006932e4]
test eax, eax
jge 0x5ec8a4
call fcn.0040afc0
mov ecx, dword [0x006940e4]
test ecx, ecx
jge 0x5ec8b3
call fcn.0040afc0
mov edx, dword [0x00695880]
test edx, edx
jge 0x5ec8c2
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006931b8]
add eax, dword [0x006932f4]
mov ecx, dword [0x006934b8]
add ecx, dword [0x0069354c]
cmp eax, ecx
jle 0x5ec8fb
mov dword [0x006931b8], 0xe6
mov eax, dword [0x00696138]
cmp eax, dword [0x00696570]
je 0x5ec915
mov eax, dword [0x00696138]
mov dword [0x00696570], eax
mov eax, dword [0x00695928]
add eax, dword [0x00695d84]
mov ecx, dword [0x006962e8]
add ecx, dword [0x00696898]
cmp eax, ecx
jle 0x5ec93d
mov eax, dword [0x00696898]
mov dword [0x00695928], eax
mov eax, dword [0x006942c4]
mov dword [0x006940a4], eax
mov eax, dword [0x00693424]
add eax, 1
cmp dword [0x00693424], eax
jne 0x5ec9c7
mov eax, dword [0x006940a0]
test eax, eax
jge 0x5ec969
call fcn.0040afc0
mov ecx, dword [0x00695884]
test ecx, ecx
jge 0x5ec978
call fcn.0040afc0
mov edx, dword [0x00695bb4]
test edx, edx
jge 0x5ec987
call fcn.0040afc0
mov r8d, dword [0x00696198]
test r8d, r8d
jge 0x5ec998
call fcn.0040afc0
mov r9d, dword [0x006965d0]
test r9d, r9d
jge 0x5ec9a9
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x0069591c]
add eax, dword [0x00695d78]
mov ecx, dword [0x006962e0]
add ecx, dword [0x0069688c]
cmp eax, ecx
jle 0x5ec9ef
mov eax, dword [0x0069688c]
mov dword [0x0069591c], eax
mov eax, dword [0x00696cb8]
mov dword [0x006965e8], eax
mov eax, dword [0x00693434]
add eax, 1
cmp dword [0x00693434], eax
jne 0x5eca22
mov eax, dword [0x00696e8c]
test eax, eax
jge 0x5eca1b
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
lea rcx, [0x006a8980]
mov edx, 0x88
xor r8, r8
call fcn.0040a9a0
call fcn.005e7b40
cmp eax, dword [0x00696e90]
jle 0x5eca4e
mov dword [0x00696e90], 0x24
call fcn.005dea10
mov eax, dword [0x00696e4c]
add eax, dword [0x006932a0]
mov ecx, dword [0x0069340c]
add ecx, dword [0x00693540]
cmp eax, ecx
jle 0x5eca79
mov dword [0x00696e4c], 0x61
lea rcx, [rbp + 0x670]
call fcn.005ce0e0
lea rcx, [0x006a8a10]
mov rdx, qword [rbp + 0x670]
call fcn.004108e0
call fcn.005ea1d0
cmp eax, dword [0x00693200]
jle 0x5ecaaf
mov dword [0x00693200], 0x4c
mov eax, dword [0x0069584c]
add eax, dword [0x006958f8]
mov ecx, dword [0x00695c0c]
add ecx, dword [0x006961a8]
cmp eax, ecx
jle 0x5ecad7
mov eax, dword [0x006961a8]
mov dword [0x0069584c], eax
mov eax, dword [0x00693304]
add eax, 1
cmp dword [0x00693304], eax
jne 0x5ecb28
mov eax, dword [0x00693950]
test eax, eax
jge 0x5ecaf7
call fcn.0040afc0
mov ecx, dword [0x006957f8]
test ecx, ecx
jge 0x5ecb06
call fcn.0040afc0
mov edx, dword [0x0069593c]
test edx, edx
jge 0x5ecb15
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.005d9cb0
mov eax, dword [0x0069584c]
add eax, dword [0x006958f8]
mov ecx, dword [0x00695c0c]
add ecx, dword [0x006961a8]
cmp eax, ecx
jle 0x5ecb55
mov eax, dword [0x006961a8]
mov dword [0x0069584c], eax
mov eax, dword [0x006961a4]
cmp eax, dword [0x00696590]
je 0x5ecb6f
mov eax, dword [0x006961a4]
mov dword [0x00696590], eax
mov eax, dword [0x00696a8c]
mov dword [0x006965c8], eax
call qword [0x006a8d20]
mov ecx, eax
lea rdx, [0x006a8a30]
call qword [0x006a8d10]
mov eax, dword [0x006933d4]
add eax, 1
cmp dword [0x006933d4], eax
jne 0x5ecbe1
mov eax, dword [0x00693290]
test eax, eax
jge 0x5ecbb0
call fcn.0040afc0
mov ecx, dword [0x00694124]
test ecx, ecx
jge 0x5ecbbf
call fcn.0040afc0
mov edx, dword [0x00695878]
test edx, edx
jge 0x5ecbce
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00695824]
add eax, dword [0x006958d4]
mov ecx, dword [0x00695be8]
add ecx, dword [0x00696184]
cmp eax, ecx
jle 0x5ecc02
call fcn.004096f0
mov eax, dword [0x00695864]
mov dword [0x006942a0], eax
mov eax, dword [0x00695b94]
add eax, dword [0x0069612c]
mov ecx, dword [0x006962d4]
add ecx, dword [0x006965f8]
cmp eax, ecx
jle 0x5ecc36
mov eax, dword [0x006965f8]
mov dword [0x00695b94], eax
mov eax, dword [0x006932c4]
add eax, 1
cmp dword [0x006932c4], eax
jne 0x5ecc5d
mov eax, dword [0x00693304]
test eax, eax
jge 0x5ecc56
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006931d4]
mov dword [0x00696ab0], eax
mov eax, dword [0x006933b8]
add eax, 1
cmp dword [0x006933b8], eax
jne 0x5ecc90
mov eax, dword [0x0069590c]
test eax, eax
jge 0x5ecc89
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006931d4]
mov dword [0x00696ab0], eax
mov eax, dword [0x00696174]
cmp eax, dword [0x00696318]
je 0x5eccb6
mov eax, dword [0x00696174]
mov dword [0x00696318], eax
mov dword [0x0069320c], 0x2f7
mov eax, dword [0x0069320c]
sub eax, 0x19e
mov dword [0x006933dc], eax
call qword [0x006a8d20]
lea rcx, [rbp + 0x668]
mov edx, eax
call fcn.005a4400
lea rcx, [0x006a8a20]
mov rdx, qword [rbp + 0x668]
call fcn.004108e0
mov eax, dword [0x00696c90]
mov dword [0x00696890], eax
call fcn.005e9c80
cmp eax, dword [0x00693284]
jle 0x5ecd1c
mov dword [0x00693284], 0x55
mov eax, dword [0x00696cc0]
add eax, dword [0x0069327c]
mov ecx, dword [0x006933e8]
add ecx, dword [0x006934d4]
cmp eax, ecx
jle 0x5ecd42
mov dword [0x00696cc0], 0
mov dword [0x00693290], 0x325
mov eax, dword [0x00693290]
sub eax, 0x1b4
mov dword [0x006933fc], eax
mov eax, dword [0x006932a8]
add eax, 1
cmp dword [0x006932a8], eax
jne 0x5ecddc
mov eax, dword [0x00695890]
test eax, eax
jge 0x5ecd7e
call fcn.0040afc0
mov ecx, dword [0x00695d9c]
test ecx, ecx
jge 0x5ecd8d
call fcn.0040afc0
mov edx, dword [0x006965dc]
test edx, edx
jge 0x5ecd9c
call fcn.0040afc0
mov r8d, dword [0x00696e60]
test r8d, r8d
jge 0x5ecdad
call fcn.0040afc0
mov r9d, dword [0x006933d8]
test r9d, r9d
jge 0x5ecdbe
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x006958a0]
add eax, dword [0x00695bd0]
mov ecx, dword [0x00696120]
add ecx, dword [0x00696310]
cmp eax, ecx
jle 0x5ece04
mov eax, dword [0x00696310]
mov dword [0x006958a0], eax
call fcn.005e4a50
call fcn.005e7100
cmp eax, dword [0x00696cac]
jle 0x5ece20
mov dword [0x00696cac], 0x17
lea rcx, [rbp + 0x650]
lea rdx, [0x00692ce6]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x658]
mov rdx, qword [rbp + 0x650]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x640]
lea rdx, [0x00692cee]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x648]
mov rdx, qword [rbp + 0x640]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x660]
mov edx, 3
mov r8, qword [rbp + 0x658]
lea r9, [0x005f1668]
mov rax, qword [rbp + 0x648]
mov qword [rsp + 0x20], rax
call fcn.00410400
mov rcx, qword [rbp + 0x660]
call fcn.00410050
lea rcx, [0x006a8a28]
mov rdx, rax
call fcn.0040fee0
call fcn.005e5470
cmp eax, dword [0x00696ca0]
jle 0x5eceec
mov dword [0x00696ca0], 0x15
call fcn.005d9cb0
call fcn.005e4a50
call fcn.005e8520
cmp eax, dword [0x006931f0]
jle 0x5ecf0d
mov dword [0x006931f0], 0x48
mov eax, dword [0x00695844]
mov dword [0x00694138], eax
mov eax, dword [0x00693204]
mov dword [0x00696ca4], eax
lea rcx, [rbp + 0x628]
call fcn.005cca90
lea rcx, [rbp + 0x630]
mov rdx, qword [rbp + 0x628]
call fcn.005a6760
lea rcx, [rbp + 0x638]
mov rdx, qword [rbp + 0x630]
call fcn.0042d7c0
lea rcx, [0x006a82f0]
mov rdx, qword [rbp + 0x638]
call fcn.00430440
lea rcx, [rbp + 0x618]
lea rdx, [0x006a82f0]
mov r8d, 0x104
call fcn.00410830
lea rcx, [rbp + 0x620]
mov rdx, qword [rbp + 0x618]
call fcn.0042fe90
lea rcx, [0x006a84f8]
mov rdx, qword [rbp + 0x620]
call fcn.00430440
call fcn.005e3480
mov eax, dword [0x00693204]
mov dword [0x00696ca4], eax
mov eax, dword [0x00696144]
cmp eax, dword [0x006965c8]
je 0x5ecfd5
mov eax, dword [0x00696144]
mov dword [0x006965c8], eax
mov eax, dword [0x00693204]
add eax, 1
cmp dword [0x00693204], eax
jne 0x5ecffc
mov eax, dword [0x00693510]
test eax, eax
jge 0x5ecff5
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
lea rcx, [rbp + 0x600]
call fcn.005cca90
lea rcx, [rbp + 0x608]
mov rdx, qword [rbp + 0x600]
call fcn.0042fe90
lea rcx, [rbp + 0x610]
mov rdx, qword [rbp + 0x608]
call fcn.0042d7c0
lea rcx, [rbp + 0x6b8]
mov rdx, qword [rbp + 0x610]
call fcn.004108e0
mov dword [rbp + 0x698], 0
mov rax, qword [rbp + 0x6b8]
test rax, rax
je 0x5ed063
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x698], eax
lea rcx, [rbp + 0x6b8]
mov rdx, qword [rbp + 0x6b8]
mov r8d, 1
mov r9d, dword [rbp + 0x698]
sub r9d, 1
call fcn.00410530
jmp 0x5ed0b9
lea rcx, [0x005f1668]
mov rdx, qword [rbp + 0x6b8]
mov r8d, 1
call fcn.00410fd0
lea rcx, [rbp + 0x6b8]
mov edx, 1
mov r8d, eax
call fcn.00410590
lea rcx, [0x005f1668]
mov rdx, qword [rbp + 0x6b8]
mov r8d, 1
call fcn.00410fd0
test eax, eax
jne 0x5ed08a
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x6b8]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8721]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
mov eax, dword [0x00695850]
add eax, dword [0x00695948]
mov ecx, dword [0x00696118]
add ecx, dword [0x00696308]
cmp eax, ecx
jle 0x5ed128
call fcn.004096f0
mov eax, dword [0x00695850]
add eax, dword [0x00695948]
mov ecx, dword [0x00696118]
add ecx, dword [0x00696308]
cmp eax, ecx
jle 0x5ed149
call fcn.004096f0
mov eax, dword [0x006962c4]
cmp eax, dword [0x006965e8]
je 0x5ed163
mov eax, dword [0x006962c4]
mov dword [0x006965e8], eax
mov eax, dword [0x006958c8]
mov dword [0x006942e4], eax
mov eax, dword [0x006958c8]
mov dword [0x006942e4], eax
mov eax, dword [0x006962f0]
cmp eax, dword [0x0069689c]
je 0x5ed195
mov eax, dword [0x006962f0]
mov dword [0x0069689c], eax
mov eax, dword [0x00695884]
add eax, dword [0x00695bb8]
mov ecx, dword [0x00695d90]
add ecx, dword [0x006962f4]
cmp eax, ecx
jle 0x5ed1bd
mov eax, dword [0x006962f4]
mov dword [0x00695884], eax
mov eax, dword [0x006931c4]
mov dword [0x00696aa4], eax
lea rcx, [rbp + 0x4f0]
lea rdx, [0x006a82f0]
mov r8d, 0x104
call fcn.00410830
lea rcx, [rbp + 0x4f8]
mov rdx, qword [rbp + 0x4f0]
call fcn.004300a0
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x4f8]
mov r8d, 0xff
call fcn.00410910
lea rcx, [0x006a8763]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
lea rcx, [rbp + 0x4c0]
lea rdx, [0x006a8763]
call fcn.004109a0
lea rcx, [0x005f1678]
mov rdx, qword [rbp + 0x4c0]
mov r8d, 1
call fcn.00410f20
lea rcx, [rbp + 0x4c8]
lea rdx, [0x006a8763]
mov r8d, 1
mov r9d, eax
sub r9d, 1
call fcn.0040f4b0
lea rcx, [rbp + 0x6b8]
lea rdx, [rbp + 0x4c8]
call fcn.0040ff20
lea rcx, [rbp + 0x6b0]
lea rdx, [0x006a8763]
call fcn.0040ff20
call fcn.005da060
mov eax, dword [0x006934ec]
add eax, 1
cmp dword [0x006934ec], eax
jne 0x5ed307
mov eax, dword [0x00693510]
test eax, eax
jge 0x5ed2bf
call fcn.0040afc0
mov ecx, dword [0x0069580c]
test ecx, ecx
jge 0x5ed2ce
call fcn.0040afc0
mov edx, dword [0x0069594c]
test edx, edx
jge 0x5ed2dd
call fcn.0040afc0
mov r8d, dword [0x00696168]
test r8d, r8d
jge 0x5ed2ee
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006931c4]
mov dword [0x00696aa4], eax
mov eax, dword [0x00696120]
cmp eax, dword [0x006962c8]
je 0x5ed32d
mov eax, dword [0x00696120]
mov dword [0x006962c8], eax
lea rcx, [0x005f1680]
mov rdx, qword [rbp + 0x6b0]
mov r8d, 1
call fcn.00410fd0
lea rcx, [rbp + 0x6b0]
mov edx, 1
mov r8d, eax
sub r8d, 1
call fcn.00410590
mov eax, dword [0x00695b90]
add eax, dword [0x00695d6c]
mov ecx, dword [0x006962d0]
add ecx, dword [0x006965f8]
cmp eax, ecx
jle 0x5ed388
mov eax, dword [0x006965f8]
mov dword [0x00695b90], eax
mov dword [rbp + 0x694], 0
mov rax, qword [rbp + 0x6b8]
test rax, rax
je 0x5ed3aa
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x694], eax
lea rcx, [rbp + 0x6b8]
mov rdx, qword [rbp + 0x6b8]
mov r8d, 1
mov r9d, dword [rbp + 0x694]
sub r9d, 2
call fcn.00410530
lea rcx, [rbp + 0x4b8]
mov edx, 3
mov r8, qword [rbp + 0x6b8]
lea r9, [0x005f1688]
mov rax, qword [rbp + 0x6b0]
mov qword [rsp + 0x20], rax
call fcn.00410400
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x4b8]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8742]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
mov byte [rbp + 0x6cf], 0
mov eax, dword [0x00695b90]
add eax, dword [0x00695d6c]
mov ecx, dword [0x006962d0]
add ecx, dword [0x006965f8]
cmp eax, ecx
jle 0x5ed45a
mov eax, dword [0x006965f8]
mov dword [0x00695b90], eax
mov eax, dword [0x006962c4]
cmp eax, dword [0x006965e8]
je 0x5ed474
mov eax, dword [0x006962c4]
mov dword [0x006965e8], eax
mov eax, dword [0x00695870]
add eax, dword [0x0069591c]
mov ecx, dword [0x00695d7c]
add ecx, dword [0x00696180]
cmp eax, ecx
jle 0x5ed49c
mov eax, dword [0x00696180]
mov dword [0x00695870], eax
mov eax, dword [0x00696cdc]
mov dword [0x00696890], eax
mov eax, dword [0x00695844]
add eax, dword [0x0069593c]
mov ecx, dword [0x00695c08]
add ecx, dword [0x006961a0]
cmp eax, ecx
jle 0x5ed4d0
mov eax, dword [0x006961a0]
mov dword [0x00695844], eax
call fcn.005d9cb0
mov eax, dword [0x006931b8]
add eax, dword [0x006932f4]
mov ecx, dword [0x006934bc]
add ecx, dword [0x00693910]
cmp eax, ecx
jle 0x5ed4fb
mov dword [0x006931b8], 0xd4
mov rcx, qword [0x004d2058]
mov dl, 1
call fcn.0040b440
mov qword [rbp + 0x6c0], rax
nop
mov eax, dword [0x00695840]
add eax, dword [0x0069593c]
mov ecx, dword [0x00695d98]
add ecx, dword [0x006962fc]
cmp eax, ecx
jle 0x5ed532
call fcn.004096f0
mov eax, dword [0x006931e8]
add eax, dword [0x006933b4]
mov ecx, dword [0x006934e8]
add ecx, dword [0x0069393c]
cmp eax, ecx
jle 0x5ed558
mov dword [0x006931e8], 0x9a
mov eax, dword [0x006933fc]
add eax, 1
cmp dword [0x006933fc], eax
jne 0x5ed57f
mov eax, dword [0x00695920]
test eax, eax
jge 0x5ed578
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov dword [0x00693290], 0x306
mov eax, dword [0x00693290]
sub eax, 0x1a5
mov dword [0x006933fc], eax
call fcn.005e3480
mov eax, dword [0x006968b0]
mov dword [0x00696300], eax
call fcn.005e7700
cmp eax, dword [0x00696e64]
jle 0x5ed5c3
mov dword [0x00696e64], 0x2b
mov eax, dword [0x006968b0]
mov dword [0x00696300], eax
mov eax, dword [0x00695d70]
cmp eax, dword [0x006962d4]
je 0x5ed5e9
mov eax, dword [0x00695d70]
mov dword [0x006962d4], eax
mov eax, dword [0x00695b88]
add eax, dword [0x00695c1c]
mov ecx, dword [0x006962c8]
add ecx, dword [0x006965f0]
cmp eax, ecx
jle 0x5ed611
mov eax, dword [0x006965f0]
mov dword [0x00695b88], eax
lea rcx, [rbp + 0x4a0]
lea rdx, [0x006924a5]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x4a8]
mov rdx, qword [rbp + 0x4a0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x490]
lea rdx, [0x006924cf]
mov r8d, 6
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x498]
mov rdx, qword [rbp + 0x490]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x4c8]
lea rdx, [0x006a8721]
mov r8d, 1
mov r9d, 5
call fcn.0040f4b0
lea rcx, [rbp + 0x488]
lea rdx, [rbp + 0x4c8]
call fcn.0040ff20
lea rcx, [rbp + 0x4b0]
mov edx, 4
mov r8, qword [rbp + 0x4a8]
mov r9, qword [rbp + 0x498]
mov rax, qword [rbp + 0x488]
mov qword [rsp + 0x20], rax
lea rax, [0x005f1694]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov rcx, qword [rbp + 0x4b0]
lea rdx, [0x006a82f0]
mov r8d, 0x650
call fcn.005d0e40
test al, al
je 0x5ed843
mov eax, dword [0x006933ac]
add eax, 1
cmp dword [0x006933ac], eax
jne 0x5ed775
mov eax, dword [0x0069581c]
test eax, eax
jge 0x5ed72d
call fcn.0040afc0
mov ecx, dword [0x006965b4]
test ecx, ecx
jge 0x5ed73c
call fcn.0040afc0
mov edx, dword [0x00696e80]
test edx, edx
jge 0x5ed74b
call fcn.0040afc0
mov r8d, dword [0x006933ac]
test r8d, r8d
jge 0x5ed75c
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005ea0b0
cmp eax, dword [0x00693290]
jle 0x5ed78c
mov dword [0x00693290], 0x58
mov eax, dword [0x006934c8]
add eax, dword [0x0069391c]
mov ecx, dword [0x006940bc]
add ecx, dword [0x006942dc]
cmp eax, ecx
jle 0x5ed7b2
mov dword [0x006934c8], 0
mov eax, dword [0x00693408]
add eax, 1
cmp dword [0x00693408], eax
jne 0x5ed803
mov eax, dword [0x006932e4]
test eax, eax
jge 0x5ed7d2
call fcn.0040afc0
mov ecx, dword [0x0069353c]
test ecx, ecx
jge 0x5ed7e1
call fcn.0040afc0
mov edx, dword [0x006940e4]
test edx, edx
jge 0x5ed7f0
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069580c]
add eax, dword [0x00695904]
mov ecx, dword [0x00695bd0]
add ecx, dword [0x00696168]
cmp eax, ecx
jle 0x5ed824
call fcn.004096f0
mov eax, dword [0x00696abc]
mov dword [0x006965b0], eax
call fcn.005e7c60
cmp dword [0x006a893c], 0xffffffff
jne 0x5ed843
jmp 0x5ef573
mov eax, dword [0x00695b90]
add eax, dword [0x00695d6c]
mov ecx, dword [0x006962d0]
add ecx, dword [0x006965f4]
cmp eax, ecx
jle 0x5ed86b
mov eax, dword [0x006965f4]
mov dword [0x00695b90], eax
mov eax, dword [0x006942bc]
add eax, dword [0x00695880]
mov ecx, dword [0x00695bb0]
add ecx, dword [0x00695d8c]
cmp eax, ecx
jle 0x5ed88c
call fcn.004096f0
mov eax, dword [0x00696a94]
mov dword [0x00696588], eax
mov eax, dword [0x00696a94]
mov dword [0x00696588], eax
mov eax, dword [0x00695bec]
cmp eax, dword [0x00696184]
je 0x5ed8be
mov eax, dword [0x00695bec]
mov dword [0x00696184], eax
mov eax, dword [0x00696180]
add eax, dword [0x006965b8]
mov ecx, dword [0x0069591c]
add ecx, dword [0x00695d78]
cmp ecx, eax
jle 0x5ed8e6
mov ecx, dword [0x006965b8]
mov dword [0x0069591c], ecx
mov ecx, dword [0x0069591c]
add ecx, dword [0x00695d78]
cmp ecx, eax
jle 0x5ed902
mov eax, dword [0x006965b8]
mov dword [0x0069591c], eax
mov eax, dword [0x00696184]
cmp eax, dword [0x00696574]
je 0x5ed91c
mov eax, dword [0x00696184]
mov dword [0x00696574], eax
mov eax, dword [0x00695850]
add eax, dword [0x00695900]
mov ecx, dword [0x00695c14]
add ecx, dword [0x00696164]
cmp eax, ecx
jle 0x5ed944
mov eax, dword [0x00696164]
mov dword [0x00695850], eax
mov eax, dword [0x0069688c]
mov dword [0x006962e0], eax
lea rcx, [rbp + 0x478]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x470]
lea rdx, [0x006a8721]
call fcn.0040ff20
lea rcx, [rbp + 0x460]
lea rdx, [0x006924ca]
mov r8d, 4
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x468]
mov rdx, qword [rbp + 0x460]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x480]
mov edx, 3
mov r8, qword [rbp + 0x478]
mov r9, qword [rbp + 0x470]
mov rax, qword [rbp + 0x468]
mov qword [rsp + 0x20], rax
call fcn.00410400
lea rcx, [rbp + 0x458]
mov rdx, qword [rbp + 0x480]
call fcn.004108b0
mov rcx, qword [rbp + 0x458]
mov dl, 1
call fcn.0042f710
test al, al
je 0x5edf5b
call fcn.005e7700
cmp eax, dword [0x00696cb8]
jle 0x5eda20
mov dword [0x00696cb8], 0x1a
mov eax, dword [0x0069688c]
mov dword [0x006962e0], eax
mov eax, dword [0x0069593c]
cmp eax, dword [0x00695d98]
je 0x5eda46
mov eax, dword [0x0069593c]
mov dword [0x00695d98], eax
mov dword [0x00693210], 0x318
mov eax, dword [0x00693210]
sub eax, 0x19e
mov dword [0x00693304], eax
call fcn.005e6000
cmp eax, dword [0x00696cbc]
jle 0x5eda79
mov dword [0x00696cbc], 9
call fcn.005e7940
cmp eax, dword [0x00696cd0]
jle 0x5eda90
mov dword [0x00696cd0], 0xe
mov eax, dword [0x006962dc]
mov dword [0x00696138], eax
mov eax, dword [0x006933dc]
add eax, 1
cmp dword [0x006933dc], eax
jne 0x5edaed
mov eax, dword [0x00693938]
test eax, eax
jge 0x5edabc
call fcn.0040afc0
mov ecx, dword [0x0069582c]
test ecx, ecx
jge 0x5edacb
call fcn.0040afc0
mov edx, dword [0x00695924]
test edx, edx
jge 0x5edada
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069586c]
add eax, dword [0x00695ba0]
mov ecx, dword [0x00695d78]
add ecx, dword [0x00696180]
cmp eax, ecx
jle 0x5edb15
mov eax, dword [0x00696180]
mov dword [0x0069586c], eax
nop
lea rcx, [rbp + 0x448]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x440]
lea rdx, [0x006a8721]
call fcn.0040ff20
lea rcx, [rbp + 0x430]
lea rdx, [0x006924ca]
mov r8d, 4
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x438]
mov rdx, qword [rbp + 0x430]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x450]
mov edx, 3
mov r8, qword [rbp + 0x448]
mov r9, qword [rbp + 0x440]
mov rax, qword [rbp + 0x438]
mov qword [rsp + 0x20], rax
call fcn.00410400
lea rcx, [rbp + 0x428]
mov rdx, qword [rbp + 0x450]
call fcn.004108b0
mov rcx, qword [rbp + 0x6c0]
mov rdx, qword [rbp + 0x428]
call fcn.004fd2e0
mov rcx, qword [rbp + 0x6c0]
xor edx, edx
xor r8, r8
mov rax, qword [rbp + 0x6c0]
mov rax, qword [rax]
call qword [rax + 0x48]
mov eax, dword [0x006942e4]
mov dword [0x00694110], eax
mov eax, dword [0x00696cd4]
mov dword [0x00696a7c], eax
mov eax, dword [0x00694300]
mov dword [0x00694128], eax
mov eax, dword [0x006934b8]
add eax, 1
cmp dword [0x006934b8], eax
jne 0x5edc87
mov eax, dword [0x006933f8]
test eax, eax
jge 0x5edc29
call fcn.0040afc0
mov ecx, dword [0x00693938]
test ecx, ecx
jge 0x5edc38
call fcn.0040afc0
mov edx, dword [0x006942b0]
test edx, edx
jge 0x5edc47
call fcn.0040afc0
mov r8d, dword [0x00695874]
test r8d, r8d
jge 0x5edc58
call fcn.0040afc0
mov r9d, dword [0x00695d80]
test r9d, r9d
jge 0x5edc69
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x00696144]
add eax, dword [0x006962ec]
mov ecx, dword [0x0069592c]
add ecx, dword [0x00695bf4]
cmp ecx, eax
jle 0x5edcaf
mov ecx, dword [0x006962ec]
mov dword [0x0069592c], ecx
mov ecx, dword [0x0069592c]
add ecx, dword [0x00695bf4]
cmp ecx, eax
jle 0x5edccb
mov eax, dword [0x006962ec]
mov dword [0x0069592c], eax
mov eax, dword [0x00696118]
cmp eax, dword [0x006961ac]
je 0x5edce5
mov eax, dword [0x00696118]
mov dword [0x006961ac], eax
mov eax, dword [0x00695878]
add eax, dword [0x00695924]
mov ecx, dword [0x00695bf0]
add ecx, dword [0x00696140]
cmp eax, ecx
jle 0x5edd0d
mov eax, dword [0x00696140]
mov dword [0x00695878], eax
mov eax, dword [0x006931d0]
add eax, 1
cmp dword [0x006931d0], eax
jne 0x5edd8b
mov eax, dword [0x00693924]
test eax, eax
jge 0x5edd2d
call fcn.0040afc0
mov ecx, dword [0x00695818]
test ecx, ecx
jge 0x5edd3c
call fcn.0040afc0
mov edx, dword [0x00695910]
test edx, edx
jge 0x5edd4b
call fcn.0040afc0
mov r8d, dword [0x00695d6c]
test r8d, r8d
jge 0x5edd5c
call fcn.0040afc0
mov r9d, dword [0x006962d0]
test r9d, r9d
jge 0x5edd6d
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov rcx, qword [rbp + 0x6c0]
lea rdx, [0x006a82f0]
mov r8d, 0x650
call fcn.004fab00
cmp dword [0x006a893c], 0xffffffff
je 0x5eddba
mov byte [rbp + 0x6cf], 1
jmp 0x5ede52
lea rcx, [rbp + 0x410]
call fcn.005cca90
lea rcx, [rbp + 0x418]
mov rdx, qword [rbp + 0x410]
call fcn.005a6760
lea rcx, [rbp + 0x420]
mov rdx, qword [rbp + 0x418]
call fcn.0042d7c0
lea rcx, [0x006a82f0]
mov rdx, qword [rbp + 0x420]
call fcn.00430440
jmp 0x5ede52
mov dword [0x00696e58], 0x312
mov eax, dword [0x00696e58]
sub eax, 0x19b
mov dword [0x00693200], eax
mov eax, dword [0x00696c98]
mov dword [0x0069689c], eax
mov eax, dword [0x006931dc]
add eax, 1
cmp dword [0x006931dc], eax
jne 0x5edef8
mov eax, dword [0x00696e50]
test eax, eax
jge 0x5ede9a
call fcn.0040afc0
mov ecx, dword [0x006940f0]
test ecx, ecx
jge 0x5edea9
call fcn.0040afc0
mov edx, dword [0x006957f8]
test edx, edx
jge 0x5edeb8
call fcn.0040afc0
mov r8d, dword [0x0069588c]
test r8d, r8d
jge 0x5edec9
call fcn.0040afc0
mov r9d, dword [0x00695bbc]
test r9d, r9d
jge 0x5ededa
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x00696c98]
mov dword [0x0069689c], eax
mov eax, dword [0x00695bfc]
cmp eax, dword [0x0069614c]
je 0x5edf1e
mov eax, dword [0x00695bfc]
mov dword [0x0069614c], eax
mov eax, dword [0x006940a0]
mov dword [0x0069394c], eax
call fcn.005e7100
cmp eax, dword [0x00696ca8]
jle 0x5edf41
mov dword [0x00696ca8], 4
mov eax, dword [0x00696570]
mov dword [0x00696180], eax
cmp byte [rbp + 0x6cf], 0
jne 0x5edf5b
jmp 0x5ef573
mov eax, dword [0x006932c0]
add eax, 1
cmp dword [0x006932c0], eax
jne 0x5edfac
mov eax, dword [0x006968a0]
test eax, eax
jge 0x5edf7b
call fcn.0040afc0
mov ecx, dword [0x00693414]
test ecx, ecx
jge 0x5edf8a
call fcn.0040afc0
mov edx, dword [0x00693908]
test edx, edx
jge 0x5edf99
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
lea rcx, [rbp + 0x408]
call fcn.005eb1c0
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x408]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8700]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
mov dword [rbp + 0x6ac], 1
lea rcx, [rbp + 0x3e8]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x3e0]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x3e8]
mov rdx, qword [rbp + 0x3e0]
call fcn.00410aa0
lea rcx, [rbp + 0x3d8]
mov rdx, qword [rbp + 0x3e8]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x3f0]
mov rdx, qword [rbp + 0x3d8]
call fcn.005a8f10
lea rcx, [rbp + 0x3f8]
mov rdx, qword [rbp + 0x3f0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x400]
mov rdx, qword [rbp + 0x3f8]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x400]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8784]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov eax, dword [0x006940d4]
mov dword [0x00693934], eax
mov eax, dword [0x00695c04]
add eax, dword [0x00696154]
mov ecx, dword [0x00695888]
add ecx, dword [0x00695938]
cmp ecx, eax
jle 0x5ee0f5
mov ecx, dword [0x00696154]
mov dword [0x00695888], ecx
mov ecx, dword [0x00695888]
add ecx, dword [0x00695938]
cmp ecx, eax
jle 0x5ee111
mov eax, dword [0x00696154]
mov dword [0x00695888], eax
mov eax, dword [0x00695914]
cmp eax, dword [0x00695bdc]
je 0x5ee12b
mov eax, dword [0x00695914]
mov dword [0x00695bdc], eax
mov eax, dword [0x00693300]
add eax, 1
cmp dword [0x00693300], eax
jne 0x5ee1a9
mov eax, dword [0x00693430]
test eax, eax
jge 0x5ee14b
call fcn.0040afc0
mov ecx, dword [0x006942e4]
test ecx, ecx
jge 0x5ee15a
call fcn.0040afc0
mov edx, dword [0x00695860]
test edx, edx
jge 0x5ee169
call fcn.0040afc0
mov r8d, dword [0x00695b90]
test r8d, r8d
jge 0x5ee17a
call fcn.0040afc0
mov r9d, dword [0x00695d6c]
test r9d, r9d
jge 0x5ee18b
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x00695b88]
add eax, dword [0x00695c18]
mov ecx, dword [0x0069580c]
add ecx, dword [0x006958a0]
cmp ecx, eax
jle 0x5ee1d1
mov ecx, dword [0x00695c18]
mov dword [0x0069580c], ecx
mov ecx, dword [0x0069580c]
add ecx, dword [0x006958a0]
cmp ecx, eax
jle 0x5ee1ed
mov eax, dword [0x00695c18]
mov dword [0x0069580c], eax
mov eax, dword [0x006958f8]
cmp eax, dword [0x00695bc4]
je 0x5ee207
mov eax, dword [0x006958f8]
mov dword [0x00695bc4], eax
mov eax, dword [0x00696ab4]
add eax, dword [0x00696cc0]
mov ecx, dword [0x006931d4]
add ecx, dword [0x006932c8]
cmp eax, ecx
jle 0x5ee22d
mov dword [0x00696ab4], 0x66
lea rcx, [rbp + 0x3b8]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x3b0]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x3b8]
mov rdx, qword [rbp + 0x3b0]
call fcn.00410aa0
lea rcx, [rbp + 0x3a8]
mov rdx, qword [rbp + 0x3b8]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x3c0]
mov rdx, qword [rbp + 0x3a8]
call fcn.005a8f10
lea rcx, [rbp + 0x3c8]
mov rdx, qword [rbp + 0x3c0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x3d0]
mov rdx, qword [rbp + 0x3c8]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x3d0]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a87a5]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov eax, dword [0x00695864]
add eax, dword [0x00695914]
mov ecx, dword [0x00695bdc]
add ecx, dword [0x0069612c]
cmp eax, ecx
jle 0x5ee324
mov eax, dword [0x0069612c]
mov dword [0x00695864], eax
mov eax, dword [0x006933f4]
add eax, 1
cmp dword [0x006933f4], eax
jne 0x5ee34b
mov eax, dword [0x006934b4]
test eax, eax
jge 0x5ee344
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov dword [0x006931c8], 0x357
mov eax, dword [0x006931c8]
sub eax, 0x1bd
mov dword [0x00693210], eax
mov eax, dword [0x006958c8]
add eax, dword [0x00695b94]
mov ecx, dword [0x006942e8]
add ecx, dword [0x00695864]
cmp ecx, eax
jle 0x5ee38f
mov ecx, dword [0x00695b94]
mov dword [0x006942e8], ecx
mov ecx, dword [0x006942e8]
add ecx, dword [0x00695864]
cmp ecx, eax
jle 0x5ee3ab
mov eax, dword [0x00695b94]
mov dword [0x006942e8], eax
mov eax, dword [0x00695b94]
cmp eax, dword [0x00695d6c]
je 0x5ee3c5
mov eax, dword [0x00695b94]
mov dword [0x00695d6c], eax
mov dword [0x00696cc8], 0x302
mov eax, dword [0x00696cc8]
sub eax, 0x194
mov dword [0x00696e7c], eax
mov eax, dword [0x006942a8]
mov dword [0x006940d4], eax
mov eax, dword [0x006965b4]
mov dword [0x00696324], eax
lea rcx, [rbp + 0x388]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x380]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x388]
mov rdx, qword [rbp + 0x380]
call fcn.00410aa0
lea rcx, [rbp + 0x378]
mov rdx, qword [rbp + 0x388]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x390]
mov rdx, qword [rbp + 0x378]
call fcn.005a8f10
lea rcx, [rbp + 0x398]
mov rdx, qword [rbp + 0x390]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x3a0]
mov rdx, qword [rbp + 0x398]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x3a0]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a87e7]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
call fcn.005dade0
mov eax, dword [0x00694120]
add eax, dword [0x006942f4]
mov ecx, dword [0x00695828]
add ecx, dword [0x006958d8]
cmp eax, ecx
jle 0x5ee4ee
call fcn.004096f0
lea rcx, [rbp + 0x358]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x350]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x358]
mov rdx, qword [rbp + 0x350]
call fcn.00410aa0
lea rcx, [rbp + 0x348]
mov rdx, qword [rbp + 0x358]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x360]
mov rdx, qword [rbp + 0x348]
call fcn.005a8f10
lea rcx, [rbp + 0x368]
mov rdx, qword [rbp + 0x360]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x370]
mov rdx, qword [rbp + 0x368]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x370]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8808]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov dword [0x00696a9c], 0x2f4
mov eax, dword [0x00696a9c]
sub eax, 0x18d
mov dword [0x00696e5c], eax
mov eax, dword [0x00693290]
add eax, 1
cmp dword [0x00693290], eax
jne 0x5ee62a
mov eax, dword [0x006942a8]
test eax, eax
jge 0x5ee5f9
call fcn.0040afc0
mov ecx, dword [0x0069591c]
test ecx, ecx
jge 0x5ee608
call fcn.0040afc0
mov edx, dword [0x00695be4]
test edx, edx
jge 0x5ee617
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006965a0]
mov dword [0x00696310], eax
mov eax, dword [0x006934e4]
mov dword [0x00693444], eax
call fcn.005e7100
cmp eax, dword [0x00696cb0]
jle 0x5ee659
mov dword [0x00696cb0], 0x23d
call fcn.005e8010
cmp eax, dword [0x00696cb0]
jle 0x5ee670
mov dword [0x00696cb0], 6
mov eax, dword [0x006965ec]
mov dword [0x00696310], eax
mov eax, dword [0x00693554]
mov dword [0x0069350c], eax
mov eax, dword [0x00693554]
mov dword [0x0069350c], eax
mov eax, dword [0x00695be8]
cmp eax, dword [0x00696138]
je 0x5ee6ae
mov eax, dword [0x00695be8]
mov dword [0x00696138], eax
lea rcx, [rbp + 0x328]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x320]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x328]
mov rdx, qword [rbp + 0x320]
call fcn.00410aa0
lea rcx, [rbp + 0x318]
mov rdx, qword [rbp + 0x328]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x330]
mov rdx, qword [rbp + 0x318]
call fcn.005a8f10
lea rcx, [rbp + 0x338]
mov rdx, qword [rbp + 0x330]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x340]
mov rdx, qword [rbp + 0x338]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x340]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a87c6]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov eax, dword [0x006932d4]
add eax, 1
cmp dword [0x006932d4], eax
jne 0x5ee7a4
mov eax, dword [0x006931f4]
test eax, eax
jge 0x5ee79d
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00694284]
add eax, dword [0x00695800]
mov ecx, dword [0x00695848]
add ecx, dword [0x006958f8]
cmp eax, ecx
jle 0x5ee7cc
mov eax, dword [0x006958f8]
mov dword [0x00694284], eax
mov eax, dword [0x006932c8]
add eax, 1
cmp dword [0x006932c8], eax
jne 0x5ee81d
mov eax, dword [0x0069582c]
test eax, eax
jge 0x5ee7ec
call fcn.0040afc0
mov ecx, dword [0x00695bf0]
test ecx, ecx
jge 0x5ee7fb
call fcn.0040afc0
mov edx, dword [0x00696188]
test edx, edx
jge 0x5ee80a
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696590]
mov dword [0x006961a0], eax
mov eax, dword [0x006942c0]
add eax, dword [0x0069583c]
mov ecx, dword [0x00695884]
add ecx, dword [0x00695934]
cmp eax, ecx
jle 0x5ee851
mov eax, dword [0x00695934]
mov dword [0x006942c0], eax
call fcn.005d7a00
mov eax, dword [0x00696580]
mov dword [0x00696190], eax
mov eax, dword [0x006958ec]
add eax, dword [0x00695bb8]
mov ecx, dword [0x006957f4]
add ecx, dword [0x00695888]
cmp ecx, eax
jle 0x5ee88a
mov ecx, dword [0x00695bb8]
mov dword [0x006957f4], ecx
mov ecx, dword [0x006957f4]
add ecx, dword [0x00695888]
cmp ecx, eax
jle 0x5ee8a6
mov eax, dword [0x00695bb8]
mov dword [0x006957f4], eax
mov eax, dword [0x00695d74]
cmp eax, dword [0x0069617c]
je 0x5ee8c0
mov eax, dword [0x00695d74]
mov dword [0x0069617c], eax
lea rcx, [rbp + 0x2f8]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x2f0]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x2f8]
mov rdx, qword [rbp + 0x2f0]
call fcn.00410aa0
lea rcx, [rbp + 0x2e8]
mov rdx, qword [rbp + 0x2f8]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x300]
mov rdx, qword [rbp + 0x2e8]
call fcn.005a8f10
lea rcx, [rbp + 0x308]
mov rdx, qword [rbp + 0x300]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x310]
mov rdx, qword [rbp + 0x308]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x310]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a884a]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov eax, dword [0x006962ec]
mov dword [0x0069618c], eax
mov eax, dword [0x006940e0]
add eax, dword [0x006942b8]
mov ecx, dword [0x00694300]
add ecx, dword [0x0069587c]
cmp eax, ecx
jle 0x5ee9bc
call fcn.004096f0
mov eax, dword [0x00696aa8]
mov dword [0x006965e8], eax
mov eax, dword [0x006934f0]
mov dword [0x0069344c], eax
mov eax, dword [0x0069410c]
add eax, dword [0x00694298]
mov ecx, dword [0x00695814]
add ecx, dword [0x00695860]
cmp eax, ecx
jle 0x5ee9f5
call fcn.004096f0
mov eax, dword [0x00696594]
mov dword [0x006961a4], eax
mov eax, dword [0x0069688c]
add eax, dword [0x00696ac8]
mov ecx, dword [0x00696e88]
add ecx, dword [0x006931e8]
cmp eax, ecx
jle 0x5eea27
mov dword [0x0069688c], 0x8a
lea rcx, [rbp + 0x2c8]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x2c0]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x2c8]
mov rdx, qword [rbp + 0x2c0]
call fcn.00410aa0
lea rcx, [rbp + 0x2b8]
mov rdx, qword [rbp + 0x2c8]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2b8]
call fcn.005a8f10
lea rcx, [rbp + 0x2d8]
mov rdx, qword [rbp + 0x2d0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x2e0]
mov rdx, qword [rbp + 0x2d8]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x2e0]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a8829]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
mov eax, dword [0x006940bc]
add eax, dword [0x00694294]
mov ecx, dword [0x00695810]
add ecx, dword [0x006958a0]
cmp eax, ecx
jle 0x5eeb17
call fcn.004096f0
mov eax, dword [0x0069594c]
add eax, dword [0x00696168]
mov ecx, dword [0x006965a0]
add ecx, dword [0x00696cb8]
cmp eax, ecx
jle 0x5eeb3f
mov eax, dword [0x00696cb8]
mov dword [0x0069594c], eax
mov dword [0x006968a8], 0x2f4
mov eax, dword [0x006968a8]
sub eax, 0x17e
mov dword [0x00696ca8], eax
mov eax, dword [0x006934d4]
add eax, 1
cmp dword [0x006934d4], eax
jne 0x5eebac
mov eax, dword [0x0069396c]
test eax, eax
jge 0x5eeb7b
call fcn.0040afc0
mov ecx, dword [0x006942e4]
test ecx, ecx
jge 0x5eeb8a
call fcn.0040afc0
mov edx, dword [0x00695860]
test edx, edx
jge 0x5eeb99
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696890]
mov dword [0x00696574], eax
mov eax, dword [0x00693308]
add eax, 1
cmp dword [0x00693308], eax
jne 0x5eebdf
mov eax, dword [0x006958d4]
test eax, eax
jge 0x5eebd8
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
lea rcx, [rbp + 0x298]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x290]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x298]
mov rdx, qword [rbp + 0x290]
call fcn.00410aa0
lea rcx, [rbp + 0x288]
mov rdx, qword [rbp + 0x298]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x2a0]
mov rdx, qword [rbp + 0x288]
call fcn.005a8f10
lea rcx, [rbp + 0x2a8]
mov rdx, qword [rbp + 0x2a0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x2b0]
mov rdx, qword [rbp + 0x2a8]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x2b0]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a886b]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
add dword [rbp + 0x6ac], 1
call fcn.005dda90
mov eax, dword [0x00693520]
mov dword [0x00693434], eax
mov eax, dword [0x006933e8]
add eax, dword [0x00693430]
mov ecx, dword [0x0069351c]
add ecx, dword [0x00693928]
cmp eax, ecx
jle 0x5eece7
mov eax, dword [0x00693928]
mov dword [0x006933e8], eax
lea rcx, [rbp + 0x268]
lea rdx, [0x006a8700]
call fcn.004109a0
lea rcx, [rbp + 0x260]
mov edx, dword [rbp + 0x6ac]
call fcn.0042e830
lea rcx, [rbp + 0x268]
mov rdx, qword [rbp + 0x260]
call fcn.00410aa0
lea rcx, [rbp + 0x258]
mov rdx, qword [rbp + 0x268]
xor r8, r8
call fcn.0040fe00
lea rcx, [rbp + 0x270]
mov rdx, qword [rbp + 0x258]
call fcn.005a8f10
lea rcx, [rbp + 0x278]
mov rdx, qword [rbp + 0x270]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x280]
mov rdx, qword [rbp + 0x278]
mov r8d, 1
mov r9d, 8
call fcn.00410530
lea rcx, [rbp + 0x500]
mov rdx, qword [rbp + 0x280]
mov r8d, 0xff
call fcn.0040ffc0
lea rcx, [0x006a888c]
lea rdx, [rbp + 0x500]
mov r8b, 0x20
call fcn.0040f3e0
mov eax, dword [0x0069613c]
mov dword [0x00695bec], eax
mov dword [0x006a88b0], 4
call fcn.005e8520
cmp eax, dword [0x00696cd8]
jle 0x5eeddc
mov dword [0x00696cd8], 0x10
call fcn.005cdc90
mov dword [0x006a88b4], eax
mov eax, dword [0x0069351c]
mov dword [0x00693430], eax
call fcn.005e7940
cmp eax, dword [0x00696ccc]
jle 0x5eee0a
mov dword [0x00696ccc], 0x244
mov eax, dword [0x0069351c]
mov dword [0x00693430], eax
mov eax, dword [0x00695bd8]
cmp eax, dword [0x00695d6c]
je 0x5eee30
lea rcx, [rbp + 0x1e8]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x1e0]
lea rdx, [0x006a87a5]
call fcn.0040ff20
lea rcx, [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1e0]
call fcn.00410070
lea rcx, [rbp + 0x1d8]
mov rdx, qword [rbp + 0x1e8]
call fcn.004108b0
mov rcx, qword [rbp + 0x1d8]
mov dl, 1
call fcn.0042f7f0
test al, al
jne 0x5ef7e5
mov eax, dword [0x0069584c]
mov dword [0x006942d4], eax
mov eax, dword [0x006958e4]
add eax, dword [0x00695bb0]
mov ecx, dword [0x00696148]
add ecx, dword [0x006962f0]
cmp eax, ecx
jle 0x5ef610
mov eax, dword [0x006962f0]
mov dword [0x006958e4], eax
mov eax, dword [0x00696588]
mov dword [0x00696150], eax
mov eax, dword [0x006942c8]
add eax, dword [0x0069588c]
mov ecx, dword [0x0069593c]
add ecx, dword [0x00695d98]
cmp eax, ecx
jle 0x5ef63d
call fcn.004096f0
lea rcx, [rbp + 0x1d0]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x1c8]
lea rdx, [0x006a87a5]
call fcn.0040ff20
lea rcx, [rbp + 0x1d0]
mov rdx, qword [rbp + 0x1c8]
call fcn.00410070
mov rcx, qword [rbp + 0x1d0]
call fcn.005e96d0
lea rcx, [rbp + 0x1c0]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x1b8]
lea rdx, [0x006a87a5]
call fcn.0040ff20
lea rcx, [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1b8]
call fcn.00410070
mov rcx, qword [rbp + 0x1c0]
movsd xmm1, qword [rbp + 0x6a0]
call fcn.005e9d30
mov eax, dword [0x00693408]
add eax, 1
cmp dword [0x00693408], eax
jne 0x5ef72e
mov eax, dword [0x0069411c]
test eax, eax
jge 0x5ef6fd
call fcn.0040afc0
mov ecx, dword [0x00695d7c]
test ecx, ecx
jge 0x5ef70c
call fcn.0040afc0
mov edx, dword [0x006962e0]
test edx, edx
jge 0x5ef71b
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov dword [0x00696e58], 0x2f3
mov eax, dword [0x00696e58]
sub eax, 0x18c
mov dword [0x006932ac], eax
mov eax, dword [0x006932f8]
add eax, 1
cmp dword [0x006932f8], eax
jne 0x5ef79b
mov eax, dword [0x006934bc]
test eax, eax
jge 0x5ef76a
call fcn.0040afc0
mov ecx, dword [0x006940b0]
test ecx, ecx
jge 0x5ef779
call fcn.0040afc0
mov edx, dword [0x00695804]
test edx, edx
jge 0x5ef788
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006931e0]
mov dword [0x00696ac0], eax
mov eax, dword [0x00695bc8]
add eax, dword [0x00696160]
mov ecx, dword [0x00696308]
add ecx, dword [0x006968b4]
cmp eax, ecx
jle 0x5ef7cf
mov eax, dword [0x006968b4]
mov dword [0x00695bc8], eax
mov eax, dword [0x00696c9c]
mov dword [0x006968a0], eax
call fcn.005e4a50
call fcn.005dda90
lea rcx, [rbp + 0x1b0]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x1a8]
lea rdx, [0x006a8784]
call fcn.0040ff20
lea rcx, [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1a8]
call fcn.00410070
lea rcx, [rbp + 0x1a0]
mov rdx, qword [rbp + 0x1b0]
call fcn.004108b0
mov rcx, qword [rbp + 0x1a0]
mov dl, 1
call fcn.0042f7f0
test al, al
jne 0x5ef9d3
mov eax, dword [0x006958fc]
add eax, dword [0x00695bc4]
mov ecx, dword [0x0069615c]
add ecx, dword [0x00696304]
cmp eax, ecx
jle 0x5ef876
mov eax, dword [0x00696304]
mov dword [0x006958fc], eax
mov eax, dword [0x006933ac]
add eax, 1
cmp dword [0x006933ac], eax
jne 0x5ef8c7
mov eax, dword [0x00695d88]
test eax, eax
jge 0x5ef896
call fcn.0040afc0
mov ecx, dword [0x0069689c]
test ecx, ecx
jge 0x5ef8a5
call fcn.0040afc0
mov edx, dword [0x006931b0]
test edx, edx
jge 0x5ef8b4
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696a6c]
mov dword [0x00696318], eax
lea rcx, [rbp + 0x198]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x190]
lea rdx, [0x006a8784]
call fcn.0040ff20
lea rcx, [rbp + 0x198]
mov rdx, qword [rbp + 0x190]
call fcn.00410070
mov rcx, qword [rbp + 0x198]
call fcn.005e96d0
lea rcx, [rbp + 0x188]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x180]
lea rdx, [0x006a8784]
call fcn.0040ff20
lea rcx, [rbp + 0x188]
mov rdx, qword [rbp + 0x180]
call fcn.00410070
mov rcx, qword [rbp + 0x188]
movsd xmm1, qword [rbp + 0x6a0]
call fcn.005e9d30
call fcn.005e8470
cmp eax, dword [0x006931d8]
jle 0x5ef98a
mov dword [0x006931d8], 0x42
mov eax, dword [0x00696a6c]
mov dword [0x00696318], eax
mov eax, dword [0x0069616c]
cmp eax, dword [0x006965a8]
je 0x5ef9b0
mov eax, dword [0x0069616c]
mov dword [0x006965a8], eax
mov eax, dword [0x006932b0]
mov dword [0x00696ca8], eax
call fcn.005a2d10
cmp eax, dword [0x006932f4]
jle 0x5ef9d3
mov dword [0x006932f4], 0x72
lea rcx, [rbp + 0x178]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x170]
lea rdx, [0x006a87c6]
call fcn.0040ff20
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x170]
call fcn.00410070
lea rcx, [rbp + 0x168]
mov rdx, qword [rbp + 0x178]
call fcn.004108b0
mov rcx, qword [rbp + 0x168]
mov dl, 1
call fcn.0042f7f0
test al, al
jne 0x5efd1e
mov eax, dword [0x0069587c]
add eax, dword [0x00695bac]
mov ecx, dword [0x00696144]
add ecx, dword [0x00696580]
cmp eax, ecx
jle 0x5efa5d
call fcn.004096f0
mov eax, dword [0x00693404]
add eax, 1
cmp dword [0x00693404], eax
jne 0x5efadb
mov eax, dword [0x006958fc]
test eax, eax
jge 0x5efa7d
call fcn.0040afc0
mov ecx, dword [0x00696308]
test ecx, ecx
jge 0x5efa8c
call fcn.0040afc0
mov edx, dword [0x00696aa4]
test edx, edx
jge 0x5efa9b
call fcn.0040afc0
mov r8d, dword [0x00693210]
test r8d, r8d
jge 0x5efaac
call fcn.0040afc0
mov r9d, dword [0x00693424]
test r9d, r9d
jge 0x5efabd
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x006934c0]
add eax, 1
cmp dword [0x006934c0], eax
jne 0x5efb59
mov eax, dword [0x00696114]
test eax, eax
jge 0x5efafb
call fcn.0040afc0
mov ecx, dword [0x00696aa4]
test ecx, ecx
jge 0x5efb0a
call fcn.0040afc0
mov edx, dword [0x0069320c]
test edx, edx
jge 0x5efb19
call fcn.0040afc0
mov r8d, dword [0x006934c4]
test r8d, r8d
jge 0x5efb2a
call fcn.0040afc0
mov r9d, dword [0x00693964]
test r9d, r9d
jge 0x5efb3b
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x00696aa8]
mov dword [0x0069659c], eax
lea rcx, [rbp + 0x160]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x158]
lea rdx, [0x006a87c6]
call fcn.0040ff20
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x158]
call fcn.00410070
mov rcx, qword [rbp + 0x160]
call fcn.005e96d0
lea rcx, [rbp + 0x150]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0x148]
lea rdx, [0x006a87c6]
call fcn.0040ff20
lea rcx, [rbp + 0x150]
mov rdx, qword [rbp + 0x148]
call fcn.00410070
mov rcx, qword [rbp + 0x150]
movsd xmm1, qword [rbp + 0x6a0]
call fcn.005e9d30
mov eax, dword [0x0069352c]
add eax, 1
cmp dword [0x0069352c], eax
jne 0x5efc6d
mov eax, dword [0x00696144]
test eax, eax
jge 0x5efc25
call fcn.0040afc0
mov ecx, dword [0x006932e8]
test ecx, ecx
jge 0x5efc34
call fcn.0040afc0
mov edx, dword [0x00693900]
test edx, edx
jge 0x5efc43
call fcn.0040afc0
mov r8d, dword [0x00694134]
test r8d, r8d
jge 0x5efc54
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x0069657c]
add eax, dword [0x00696a88]
mov ecx, dword [0x00695bac]
add ecx, dword [0x00696144]
cmp ecx, eax
jle 0x5efc95
mov ecx, dword [0x00696a88]
mov dword [0x00695bac], ecx
mov ecx, dword [0x00695bac]
add ecx, dword [0x00696144]
cmp ecx, eax
jle 0x5efcb1
mov eax, dword [0x00696a88]
mov dword [0x00695bac], eax
mov eax, dword [0x00695c08]
cmp eax, dword [0x006961a4]
je 0x5efccb
mov eax, dword [0x00695c08]
mov dword [0x006961a4], eax
mov eax, dword [0x006931e4]
add eax, dword [0x006933b0]
mov ecx, dword [0x006934e4]
add ecx, dword [0x00693938]
cmp eax, ecx
jle 0x5efcf1
mov dword [0x006931e4], 0xf4
mov eax, dword [0x00696cdc]
mov dword [0x00696a84], eax
mov eax, dword [0x0069587c]
add eax, dword [0x00695bac]
mov ecx, dword [0x00696144]
add ecx, dword [0x006962ec]
cmp eax, ecx
jle 0x5efd1e
call fcn.004096f0
mov eax, dword [0x0069587c]
add eax, dword [0x00695bac]
mov ecx, dword [0x00696144]
add ecx, dword [0x006962ec]
cmp eax, ecx
jle 0x5efd3f
call fcn.004096f0
mov eax, dword [0x00695d98]
cmp eax, dword [0x006962fc]
je 0x5efd59
mov eax, dword [0x00695d98]
mov dword [0x006962fc], eax
mov eax, dword [0x00695b98]
add eax, dword [0x00696130]
mov ecx, dword [0x00696320]
add ecx, dword [0x006965fc]
cmp eax, ecx
jle 0x5efd81
mov eax, dword [0x006965fc]
mov dword [0x00695b98], eax
lea rcx, [rbp + 0x110]
lea rdx, [0x006a8700]
call fcn.0040f3b0
lea rcx, [rbp + 0x110]
lea rdx, [0x005f1698]
mov r8d, 0x21
call fcn.0040f420
lea rcx, [rbp + 0x108]
lea rdx, [rbp + 0x110]
xor r8, r8
call fcn.0040f5f0
lea rcx, [rbp + 0x138]
mov rdx, qword [rbp + 0x108]
call fcn.005a8f10
lea rcx, [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
xor r8, r8
call fcn.005a8ac0
lea rcx, [0x006a8a38]
mov rdx, qword [rbp + 0x140]
call fcn.0040f010
mov eax, dword [0x00695b98]
add eax, dword [0x00696130]
mov ecx, dword [0x00696320]
add ecx, dword [0x006965fc]
cmp eax, ecx
jle 0x5efe28
mov eax, dword [0x006965fc]
mov dword [0x00695b98], eax
mov eax, dword [0x00696158]
cmp eax, dword [0x00696590]
je 0x5efe42
mov eax, dword [0x00696158]
mov dword [0x00696590], eax
mov eax, dword [0x006934e4]
add eax, 1
cmp dword [0x006934e4], eax
jne 0x5efe69
mov eax, dword [0x006958fc]
test eax, eax
jge 0x5efe62
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006932d8]
add eax, 1
cmp dword [0x006932d8], eax
jne 0x5efed1
mov eax, dword [0x00695920]
test eax, eax
jge 0x5efe89
call fcn.0040afc0
mov ecx, dword [0x00696184]
test ecx, ecx
jge 0x5efe98
call fcn.0040afc0
mov edx, dword [0x00696890]
test edx, edx
jge 0x5efea7
call fcn.0040afc0
mov r8d, dword [0x00696e88]
test r8d, r8d
jge 0x5efeb8
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
lea rcx, [rbp + 0x110]
lea rdx, [0x006a8700]
call fcn.0040f3b0
lea rcx, [rbp + 0x110]
lea rdx, [0x005f169a]
mov r8d, 0x21
call fcn.0040f420
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x110]
xor r8, r8
call fcn.0040f5f0
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0xf0]
call fcn.005a8f10
lea rcx, [rbp + 0x100]
mov rdx, qword [rbp + 0xf8]
xor r8, r8
call fcn.005a8ac0
lea rcx, [0x006a8a40]
mov rdx, qword [rbp + 0x100]
call fcn.0040f010
mov eax, dword [0x006958e4]
add eax, dword [0x00695bac]
mov ecx, dword [0x00696144]
add ecx, dword [0x006962ec]
cmp eax, ecx
jle 0x5eff78
mov eax, dword [0x006962ec]
mov dword [0x006958e4], eax
mov eax, dword [0x00693278]
mov dword [0x00696cbc], eax
mov eax, dword [0x0069593c]
add eax, dword [0x00695d98]
mov ecx, dword [0x006962fc]
add ecx, dword [0x006968ac]
cmp eax, ecx
jle 0x5effac
mov eax, dword [0x006968ac]
mov dword [0x0069593c], eax
mov eax, dword [0x00693274]
mov dword [0x00696cb8], eax
mov eax, dword [0x00693274]
mov dword [0x00696cb8], eax
mov eax, dword [0x00695d8c]
cmp eax, dword [0x006962f4]
je 0x5effde
mov eax, dword [0x00695d8c]
mov dword [0x006962f4], eax
lea rcx, [rbp + 0xe0]
lea rdx, [0x006a84f8]
mov r8d, 0x104
call fcn.0040ff40
lea rcx, [rbp + 0xd8]
lea rdx, [0x006a87e7]
call fcn.0040ff20
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xd8]
call fcn.00410070
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0xe0]
call fcn.005a9c70
lea rcx, [0x006a8a18]
mov rdx, qword [rbp + 0xe8]
call fcn.0040ff90
call fcn.005e3480
call fcn.005ea870
cmp eax, dword [0x006932d0]
jle 0x5f0060
mov dword [0x006932d0], 0x68
mov eax, dword [0x00696cd8]
mov dword [0x00696890], eax
mov eax, dword [0x006958e4]
add eax, dword [0x00695bb0]
mov ecx, dword [0x00696148]
add ecx, dword [0x00696580]
cmp eax, ecx
jle 0x5f0094
mov eax, dword [0x00696580]
mov dword [0x006958e4], eax
lea rcx, [rbp + 0xc8]
lea rdx, [0x006924a5]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0xc8]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0xb8]
lea rdx, [0x006924cf]
mov r8d, 6
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0xb8]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x4c8]
lea rdx, [0x006a8721]
mov r8d, 1
mov r9d, 5
call fcn.0040f4b0
lea rcx, [rbp + 0xb0]
lea rdx, [rbp + 0x4c8]
call fcn.0040ff20
lea rcx, [0x006a8ab0]
mov edx, 4
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xc0]
lea rax, [0x005f16a0]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov eax, dword [0x006958e4]
add eax, dword [0x00695bb0]
mov ecx, dword [0x00696148]
add ecx, dword [0x00696580]
cmp eax, ecx
jle 0x5f0196
mov eax, dword [0x00696580]
mov dword [0x006958e4], eax
mov eax, dword [0x00695d78]
cmp eax, dword [0x006962dc]
je 0x5f01b0
mov eax, dword [0x00695d78]
mov dword [0x006962dc], eax
call fcn.005e4a50
call fcn.005e7700
mov eax, dword [0x006931bc]
mov dword [0x00696a9c], eax
lea rcx, [rbp + 0xa0]
lea rdx, [0x006924a5]
mov r8d, 7
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x90]
lea rdx, [0x006924cf]
mov r8d, 6
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x90]
xor r8, r8
call fcn.005a8ac0
lea rcx, [rbp + 0x4c8]
lea rdx, [0x006a8721]
mov r8d, 1
mov r9d, 5
call fcn.0040f4b0
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0x4c8]
call fcn.0040ff20
lea rcx, [0x006a8ab8]
mov edx, 4
mov r8, qword [rbp + 0xa8]
mov r9, qword [rbp + 0x98]
lea rax, [0x005f16a8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x28], rax
call fcn.00410400
mov eax, dword [0x006931bc]
mov dword [0x00696a9c], eax
mov eax, dword [0x0069617c]
cmp eax, dword [0x006965b8]
je 0x5f02c6