Function at 0x6be228
Capabilities:
Create process on windows
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x88
push 0
push 0
dec ecx
jne 0x6be231
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 4]
call fcn.0040b9f8
mov eax, dword [ebp - 8]
call fcn.0040b9f8
mov eax, dword [ebp + 8]
call fcn.0040b9f8
lea eax, [ebp - 0x2a0]
mov edx, dword [0x4203a4]
call fcn.0040cc0c
xor eax, eax
push ebp
push 0x6bf9cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2a5], 1
mov byte [ebp - 0x2c9], 1
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00429948
test al, al
jne 0x6be2df
push 0x30
push 0x6bf9ec
push dword [ebp - 4]
push 0x6bfa1c
lea eax, [ebp - 0x2d0]
mov edx, 3
call fcn.0040c6f8
mov eax, dword [ebp - 0x2d0]
call fcn.0040c408
mov edx, eax
mov ecx, 0x6bfa20
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.006046c8
xor ebx, ebx
jmp 0x6bf969
lea eax, [ebp - 0x18]
call fcn.0040b904
lea eax, [ebp - 0x1c]
call fcn.0040b904
lea eax, [ebp - 0x2b4]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c408
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jle 0x6be523
mov eax, dword [ebp - 0x2b0]
call fcn.00406eb0
mov dword [ebp - 0x2ac], eax
xor eax, eax
push ebp
push 0x6be51c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2ac]
push eax
mov eax, dword [ebp - 0x2b0]
push eax
mov eax, dword [ebp - 0x2b4]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6be4fb
lea eax, [ebp - 0x14]
mov edx, 0x6bfa60
call fcn.0040bd3c
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0x6bfa78
mov eax, dword [ebp - 0x2ac]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6be3f6
mov eax, dword [ebp - 0x2b8]
mov ebx, dword [eax]
lea eax, [ebp - 0x2d4]
push eax
mov eax, dword [ebp - 0x2b8]
movzx eax, word [eax]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 0x2e8], 0
shr ebx, 0x10
movzx eax, bx
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 0x2d8], 0x11
lea edx, [ebp - 0x2ec]
mov ecx, 2
mov eax, 0x6bfab8
call fcn.0042a9a4
mov edx, dword [ebp - 0x2d4]
lea eax, [ebp - 0x14]
call fcn.0040bd3c
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2bc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040c408
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6be42b
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x2bc]
call fcn.0042a7bc
lea eax, [ebp - 0x14]
mov edx, 0x6bfb04
call fcn.0040bd3c
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0x6bfa78
mov eax, dword [ebp - 0x2ac]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6be4c6
mov eax, dword [ebp - 0x2b8]
mov ebx, dword [eax]
lea eax, [ebp - 0x2f0]
push eax
mov eax, dword [ebp - 0x2b8]
movzx eax, word [eax]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 0x2e8], 0
shr ebx, 0x10
movzx eax, bx
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 0x2d8], 0x11
lea edx, [ebp - 0x2ec]
mov ecx, 2
mov eax, 0x6bfab8
call fcn.0042a9a4
mov edx, dword [ebp - 0x2f0]
lea eax, [ebp - 0x14]
call fcn.0040bd3c
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2bc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040c408
push eax
mov eax, dword [ebp - 0x2ac]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6be4fb
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x2bc]
call fcn.0042a7bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6be523
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x2ac]
call fcn.00406ecc
pop eax
jmp eax
mov eax, dword [ebp - 0x1c]
mov edx, 0x6bfb28
call fcn.0040c808
jne 0x6beeb2
lea edx, [ebp - 0x2f4]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x2f4]
mov edx, 0x6bfb58
call fcn.0040c618
mov eax, dword [ebp - 0x2f4]
lea ecx, [ebp - 0x2a0]
mov edx, 0x1ff
call fcn.00429dc0
test eax, eax
jne 0x6be5d3
lea eax, [ebp - 0x2a0]
call fcn.00429e34
mov byte [ebp - 0x2a5], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2f8]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd88]
call fcn.0040c4f8
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 4]
mov edx, 0x6bfb74
call fcn.00433510
push 0x30
mov eax, dword [ebp - 0xc]
call fcn.0040c408
mov edx, eax
mov ecx, 0x6bfa20
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.006046c8
lea edx, [ebp - 0x2fc]
mov eax, dword [ebp - 4]
call fcn.0042a1c0
mov eax, dword [ebp - 0x2fc]
lea edx, [ebp - 0x24]
call fcn.00428544
lea eax, [ebp - 0x28]
call fcn.0040b904
mov eax, 0x6bfba0
mov dword [ebp - 0x32c], eax
mov eax, 0x6bfbd0
mov dword [ebp - 0x328], eax
mov eax, 0x6bfc08
mov dword [ebp - 0x324], eax
mov eax, 0x6bfc3c
mov dword [ebp - 0x320], eax
mov eax, 0x6bfc78
mov dword [ebp - 0x31c], eax
mov eax, 0x6bfcb8
mov dword [ebp - 0x318], eax
mov eax, 0x6bfd04
mov dword [ebp - 0x314], eax
mov eax, 0x6bfd40
mov dword [ebp - 0x310], eax
mov eax, 0x6bfd80
mov dword [ebp - 0x30c], eax
mov eax, 0x6bfdb8
mov dword [ebp - 0x308], eax
mov eax, 0x6bfde8
mov dword [ebp - 0x304], eax
mov eax, 0x6bfe18
mov dword [ebp - 0x300], eax
lea edx, [ebp - 0x32c]
mov ecx, 0xb
mov eax, dword [ebp - 0x24]
call fcn.004f212c
test al, al
je 0x6beeb2
lea edx, [ebp - 0x330]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x330]
mov edx, 0x6bfe54
call fcn.0040c618
mov eax, dword [ebp - 0x330]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be72e
lea edx, [ebp - 0x334]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x334]
mov edx, 0x6bfe54
call fcn.0040c618
mov ecx, dword [ebp - 0x334]
mov dl, 1
mov eax, dword [0x4f4788]
call fcn.004f4e98
mov dword [ebp - 0x2c4], eax
push 0x6bfe90
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x6bfeac
mov edx, 0x6bfed8
mov eax, dword [ebp - 0x2c4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c4]
xor edx, edx
mov dword [ebp - 0x2c4], edx
call fcn.00409af0
jmp 0x6be73b
lea eax, [ebp - 0x20]
mov edx, 0x6bfe90
call fcn.0040bd3c
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfc08
call fcn.0040c808
jne 0x6be79a
lea edx, [ebp - 0x338]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x338]
mov edx, 0x6bfef4
call fcn.0040c618
mov eax, dword [ebp - 0x338]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be79a
lea edx, [ebp - 0x33c]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x28]
mov ecx, 0x6bfef4
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfba0
call fcn.0040c808
jne 0x6be84d
lea edx, [ebp - 0x340]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x340]
mov edx, 0x6bff38
call fcn.0040c618
mov eax, dword [ebp - 0x340]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be7fd
lea edx, [ebp - 0x344]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x28]
mov ecx, 0x6bff38
call fcn.0040c670
lea edx, [ebp - 0x348]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x348]
mov edx, 0x6bff7c
call fcn.0040c618
mov eax, dword [ebp - 0x348]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be84d
lea edx, [ebp - 0x34c]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x34c]
lea eax, [ebp - 0x28]
mov ecx, 0x6bff7c
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfd80
call fcn.0040c808
jne 0x6be937
lea edx, [ebp - 0x350]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov eax, dword [ebp - 0x350]
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.00620134
lea edx, [ebp - 0x354]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x354]
mov edx, 0x6bffb4
call fcn.0040c618
mov eax, dword [ebp - 0x354]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be8cf
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x28]
mov ecx, 0x6bffb4
call fcn.0040c670
mov eax, dword [ebp - 0x20]
mov edx, 0x6bfff4
call fcn.0040c808
jne 0x6be937
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x35c]
mov edx, 0x6c0018
call fcn.0040c618
mov edx, dword [ebp - 0x35c]
mov ecx, 0x6c005c
mov eax, dword [ebp - 0x2a4]
call fcn.006be0b0
test al, al
jne 0x6be937
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x360]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0018
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfd04
call fcn.0040c808
jne 0x6be9ea
lea edx, [ebp - 0x364]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x364]
mov edx, 0x6c00ec
call fcn.0040c618
mov eax, dword [ebp - 0x364]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be99a
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x368]
lea eax, [ebp - 0x28]
mov ecx, 0x6c00ec
call fcn.0040c670
lea edx, [ebp - 0x36c]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x36c]
mov edx, 0x6c0140
call fcn.0040c618
mov eax, dword [ebp - 0x36c]
mov dl, 1
call fcn.00429948
test al, al
je 0x6be9ea
lea edx, [ebp - 0x370]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x370]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0140
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfd40
call fcn.0040c808
jne 0x6bea9d
lea edx, [ebp - 0x374]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x374]
mov edx, 0x6c0194
call fcn.0040c618
mov eax, dword [ebp - 0x374]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bea4d
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x378]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0194
call fcn.0040c670
lea edx, [ebp - 0x37c]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x37c]
mov edx, 0x6c01d0
call fcn.0040c618
mov eax, dword [ebp - 0x37c]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bea9d
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x380]
lea eax, [ebp - 0x28]
mov ecx, 0x6c01d0
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfde8
call fcn.0040c808
jne 0x6beb50
lea edx, [ebp - 0x384]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x384]
mov edx, 0x6c0210
call fcn.0040c618
mov eax, dword [ebp - 0x384]
mov dl, 1
call fcn.00429948
test al, al
je 0x6beb00
lea edx, [ebp - 0x388]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x388]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0210
call fcn.0040c670
lea edx, [ebp - 0x38c]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x38c]
mov edx, 0x6c0254
call fcn.0040c618
mov eax, dword [ebp - 0x38c]
mov dl, 1
call fcn.00429948
test al, al
je 0x6beb50
lea edx, [ebp - 0x390]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x390]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0254
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfcb8
call fcn.0040c808
jne 0x6bec03
lea edx, [ebp - 0x394]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x394]
mov edx, 0x6c02d0
call fcn.0040c618
mov eax, dword [ebp - 0x394]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bebb3
lea edx, [ebp - 0x398]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x398]
lea eax, [ebp - 0x28]
mov ecx, 0x6c02d0
call fcn.0040c670
lea edx, [ebp - 0x39c]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x39c]
mov edx, 0x6c0314
call fcn.0040c618
mov eax, dword [ebp - 0x39c]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bec03
lea edx, [ebp - 0x3a0]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3a0]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0314
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfc78
call fcn.0040c808
jne 0x6bec62
lea edx, [ebp - 0x3a4]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x3a4]
mov edx, 0x6c0358
call fcn.0040c618
mov eax, dword [ebp - 0x3a4]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bec62
lea edx, [ebp - 0x3a8]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0358
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfdb8
call fcn.0040c808
jne 0x6bece1
lea edx, [ebp - 0x3b0]
mov eax, dword [ebp - 4]
call fcn.0042a054
push dword [ebp - 0x3b0]
push 0x6c0398
push dword [ebp - 0x20]
push 0x6c03bc
lea eax, [ebp - 0x3ac]
mov edx, 4
call fcn.0040c6f8
mov eax, dword [ebp - 0x3ac]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bece1
lea edx, [ebp - 0x3b4]
mov eax, dword [ebp - 4]
call fcn.0042a054
push dword [ebp - 0x3b4]
push 0x6c0398
push dword [ebp - 0x20]
push 0x6c03bc
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040c6f8
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfbd0
call fcn.0040c808
jne 0x6bed40
lea edx, [ebp - 0x3b8]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x3b8]
mov edx, 0x6c03e0
call fcn.0040c618
mov eax, dword [ebp - 0x3b8]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bed40
lea edx, [ebp - 0x3bc]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3bc]
lea eax, [ebp - 0x28]
mov ecx, 0x6c03e0
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfe18
call fcn.0040c808
jne 0x6bed9f
lea edx, [ebp - 0x3c0]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x3c0]
mov edx, 0x6c0420
call fcn.0040c618
mov eax, dword [ebp - 0x3c0]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bed9f
lea edx, [ebp - 0x3c4]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3c4]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0420
call fcn.0040c670
mov eax, dword [ebp - 0x24]
mov edx, 0x6bfc3c
call fcn.0040c808
jne 0x6bee52
lea edx, [ebp - 0x3c8]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x3c8]
mov edx, 0x6c0464
call fcn.0040c618
mov eax, dword [ebp - 0x3c8]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bee02
lea edx, [ebp - 0x3cc]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3cc]
lea eax, [ebp - 0x28]
mov ecx, 0x6c0464
call fcn.0040c670
lea edx, [ebp - 0x3d0]
mov eax, dword [ebp - 4]
call fcn.0042a054
lea eax, [ebp - 0x3d0]
mov edx, 0x6c04c0
call fcn.0040c618
mov eax, dword [ebp - 0x3d0]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bee52
lea edx, [ebp - 0x3d4]
mov eax, dword [ebp - 4]
call fcn.0042a054
mov edx, dword [ebp - 0x3d4]
lea eax, [ebp - 0x28]
mov ecx, 0x6c04c0
call fcn.0040c670
cmp dword [ebp - 0x28], 0
je 0x6beeb2
mov byte [ebp - 0x2a5], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x3d8]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd8c]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x6c0508
call fcn.00433510
push 0x30
mov eax, dword [ebp - 0xc]
call fcn.0040c408
mov edx, eax
mov ecx, 0x6bfa20
mov eax, dword [0x738138]
mov eax, dword [eax]
call fcn.006046c8
cmp dword [ebp + 8], 0
je 0x6beebd
call fcn.00644024
mov eax, dword [ebp + 8]
mov edx, 0x6c0530
call fcn.0040c808
jne 0x6bef22
mov eax, dword [0x7384a8]
cmp byte [eax], 0
jne 0x6bef22
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3dc]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3dc]
mov ecx, 0x6c0540
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0574
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c05d8
call fcn.0040c808
jne 0x6bef87
mov eax, dword [0x7384d8]
cmp byte [eax], 0
jne 0x6bef87
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3e0]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3e0]
mov ecx, 0x6c05d8
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c05ec
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0650
call fcn.0040c808
jne 0x6befec
mov eax, dword [0x7384f4]
cmp byte [eax], 0
jne 0x6befec
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3e4]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3e4]
mov ecx, 0x6c0660
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0674
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c06d8
call fcn.0040c808
jne 0x6bf051
mov eax, dword [0x7380e8]
cmp byte [eax], 0
jne 0x6bf051
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3e8]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3e8]
mov ecx, 0x6c06e8
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c06fc
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0760
call fcn.0040c808
jne 0x6bf0b6
mov eax, dword [0x737fd0]
cmp byte [eax], 0
jne 0x6bf0b6
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3ec]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3ec]
mov ecx, 0x6c0760
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0774
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c07d8
call fcn.0040c808
jne 0x6bf11b
mov eax, dword [0x737de4]
cmp byte [eax], 0
jne 0x6bf11b
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3f0]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3f0]
mov ecx, 0x6c07e8
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c07fc
call fcn.0040bd3c
lea ecx, [ebp - 0x3f4]
mov edx, 2
mov eax, dword [ebp + 8]
call fcn.004f219c
mov eax, dword [ebp - 0x3f4]
mov edx, 0x6c085c
call fcn.0040c808
jne 0x6bf224
mov eax, dword [ebp + 8]
call fcn.006482b0
mov edx, dword [0x738194]
cmp eax, dword [edx]
jle 0x6bf224
call fcn.00432940
cmp eax, 6
jne 0x6bf1da
call fcn.00432948
cmp eax, 2
jne 0x6bf1da
mov eax, dword [ebp + 8]
mov edx, 0x6c0870
call fcn.0040c808
je 0x6bf18c
mov eax, dword [ebp + 8]
mov edx, 0x6c0884
call fcn.0040c808
jne 0x6bf1da
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3f8]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3f8]
mov ecx, 0x6c0898
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c08c0
call fcn.0040bd3c
jmp 0x6bf224
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3fc]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp + 8]
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c08c0
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0924
call fcn.0040c808
jne 0x6bf293
mov eax, dword [0x7384f4]
cmp byte [eax], 0
jne 0x6bf293
mov eax, dword [0x737de4]
cmp byte [eax], 0
jne 0x6bf293
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x400]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x400]
mov ecx, 0x6c093c
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c095c
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c09c4
call fcn.0040c808
jne 0x6bf30c
mov eax, dword [0x7380e8]
cmp byte [eax], 0
jne 0x6bf30c
mov eax, dword [0x737fd0]
cmp byte [eax], 0
jne 0x6bf30c
mov eax, dword [0x737de4]
cmp byte [eax], 0
jne 0x6bf30c
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x404]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x404]
mov ecx, 0x6c09dc
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c09fc
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0a64
call fcn.0040c808
jne 0x6bf37b
mov eax, dword [0x737fd0]
cmp byte [eax], 0
jne 0x6bf37b
mov eax, dword [0x737de4]
cmp byte [eax], 0
jne 0x6bf37b
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x408]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x408]
mov ecx, 0x6c0a80
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0aa0
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0b0c
call fcn.0040c808
je 0x6bf3ac
mov eax, dword [ebp + 8]
mov edx, 0x6c0b28
call fcn.0040c808
je 0x6bf3ac
mov eax, dword [ebp + 8]
mov edx, 0x6c0b44
call fcn.0040c808
jne 0x6bf46f
mov eax, dword [0x7380e4]
cmp byte [eax], 0
jne 0x6bf46f
mov eax, dword [0x73814c]
cmp byte [eax], 0
je 0x6bf46f
mov byte [ebp - 0x2c9], 0
call fcn.00432940
cmp eax, 6
jne 0x6bf42a
call fcn.00432948
cmp eax, 2
jne 0x6bf42a
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40c]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x40c]
mov ecx, 0x6c0898
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0b60
call fcn.0040bd3c
jmp 0x6bf46f
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x410]
mov ecx, 0x6c0bcc
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0b60
call fcn.0040bd3c
mov eax, dword [ebp + 8]
mov edx, 0x6c0c18
call fcn.0040c808
jne 0x6bf48c
mov eax, dword [0x738344]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c30
call fcn.0040c808
jne 0x6bf4a9
mov eax, dword [0x738398]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c4c
call fcn.0040c808
jne 0x6bf4c6
mov eax, dword [0x7383c8]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c4c
call fcn.0040c808
jne 0x6bf4e3
mov eax, dword [0x7383c8]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c64
call fcn.0040c808
jne 0x6bf500
mov eax, dword [0x73843c]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c80
call fcn.0040c808
jne 0x6bf51d
mov eax, dword [0x7384b0]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c9c
call fcn.0040c808
jne 0x6bf53a
mov eax, dword [0x737fc0]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0c9c
call fcn.0040c808
jne 0x6bf553
mov eax, dword [0x738014]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0cb4
call fcn.0040c808
jne 0x6bf56c
mov eax, dword [0x738310]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0cc4
call fcn.0040c808
jne 0x6bf585
mov eax, dword [0x73821c]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0cd4
call fcn.0040c808
jne 0x6bf59e
mov eax, dword [0x737be4]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0ce4
call fcn.0040c808
jne 0x6bf5b7
mov eax, dword [0x737cb0]
cmp byte [eax], 0
je 0x6bf5d0
mov eax, dword [ebp + 8]
mov edx, 0x6c0cf4
call fcn.0040c808
jne 0x6bf61a
mov eax, dword [0x738260]
cmp byte [eax], 0
jne 0x6bf61a
mov byte [ebp - 0x2c9], 0
movzx eax, byte [0x6bfb64]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x414]
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd90]
call fcn.0040c4f8
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp + 8]
mov edx, 0x6c0554
call fcn.00433510
lea eax, [ebp - 0x2c]
mov edx, 0x6c0d04
call fcn.0040bd3c
cmp byte [ebp - 0x2c9], 0
jne 0x6bf735
cmp dword [ebp - 0x10], 0
je 0x6bf735
mov eax, dword [0x737d44]
mov eax, dword [eax]
add eax, 0x454
mov edx, 0x6c0d74
call fcn.0040bcf4
mov eax, dword [0x737d44]
mov eax, dword [eax]
add eax, 0x458
mov edx, dword [ebp - 0x10]
call fcn.0040bcf4
mov eax, dword [0x737d44]
mov eax, dword [eax]
add eax, 0x464
mov edx, 0x6c0db4
call fcn.0040bcf4
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov byte [eax + 0x460], 1
mov eax, dword [0x737d44]
mov eax, dword [eax]
add eax, 0x468
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd00]
call fcn.0040bcf4
mov eax, dword [0x737d44]
mov eax, dword [eax]
add eax, 0x46c
mov edx, dword [ebp - 0x2a4]
mov edx, dword [edx + 0xd04]
call fcn.0040bcf4
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov byte [eax + 0x474], 1
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov byte [eax + 0x461], 0
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x1b4]
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov eax, dword [eax + 0x45c]
mov edx, 0x6c0dd4
call fcn.0040c808
jne 0x6bf705
mov eax, dword [ebp - 0x2c]
call fcn.006453e8
mov eax, dword [0x737d44]
mov eax, dword [eax]
call fcn.005fe8d8
mov eax, dword [0x737d44]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
xor ecx, ecx
mov dl, 1
mov eax, dword [0x64201c]
call fcn.005f6b34
mov edx, dword [0x737d44]
mov dword [edx], eax
movzx eax, byte [ebp - 0x2a5]
and al, byte [ebp - 0x2c9]
je 0x6bf967
lea eax, [ebp - 0x418]
mov ecx, 0x6c0de8
mov edx, dword [ebp - 4]
call fcn.0040c670
mov eax, dword [ebp - 0x418]
mov dl, 1
call fcn.00429948
test al, al
je 0x6bf7c7
lea eax, [ebp - 0x41c]
mov ecx, 0x6c0de8
mov edx, dword [ebp - 4]
call fcn.0040c670
mov ecx, dword [ebp - 0x41c]
mov dl, 1
mov eax, dword [0x4f4788]
call fcn.004f4e98
mov dword [ebp - 0x2c8], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x6c0e08
mov edx, 0x6c0e2c
mov eax, dword [ebp - 0x2c8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c8]
xor edx, edx
mov dword [ebp - 0x2c8], edx
call fcn.00409af0
jmp 0x6bf7cf
lea eax, [ebp - 0x30]
call fcn.0040b904
cmp dword [ebp - 0x30], 0
jne 0x6bf885
cmp byte [ebp + 0xc], 0
je 0x6bf832
push 1
lea eax, [ebp - 0x420]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 8]
call fcn.0040c670
mov eax, dword [ebp - 0x420]
call fcn.0040c408
push eax
push 0
lea eax, [ebp - 0x424]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 4]
call fcn.0040c670
mov eax, dword [ebp - 0x424]
call fcn.0040c408
push eax
push 0x6c0e70
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6bf963
push 1
lea eax, [ebp - 0x428]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 8]
call fcn.0040c670
mov eax, dword [ebp - 0x428]
call fcn.0040c408
push eax
push 0
lea eax, [ebp - 0x42c]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 4]
call fcn.0040c670
mov eax, dword [ebp - 0x42c]
call fcn.0040c408
push eax
push 0x6c0e7c
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6bf963
cmp byte [ebp + 0xc], 0
je 0x6bf8f8
push 1
lea eax, [ebp - 0x430]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 8]
call fcn.0040c670
mov eax, dword [ebp - 0x430]
call fcn.0040c408
push eax
lea eax, [ebp - 0x434]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 0x30]
call fcn.0040c670
mov eax, dword [ebp - 0x434]
call fcn.0040c408
push eax
lea eax, [ebp - 0x438]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 4]
call fcn.0040c670
mov eax, dword [ebp - 0x438]
call fcn.0040c408
push eax
push 0x6c0e70
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x6bf963
push 1
lea eax, [ebp - 0x43c]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 8]
call fcn.0040c670
mov eax, dword [ebp - 0x43c]
call fcn.0040c408
push eax
lea eax, [ebp - 0x440]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 0x30]
call fcn.0040c670
mov eax, dword [ebp - 0x440]
call fcn.0040c408
push eax
lea eax, [ebp - 0x444]
mov ecx, 0x6c0e6c
mov edx, dword [ebp - 4]
call fcn.0040c670
mov eax, dword [ebp - 0x444]
call fcn.0040c408
push eax
push 0x6c0e7c
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
jmp 0x6bf969
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bf9d6
lea eax, [ebp - 0x444]
mov edx, 0x46
call fcn.0040b964
lea eax, [ebp - 0x2fc]
mov edx, 4
call fcn.0040b964
lea eax, [ebp - 0x2d4]
mov edx, 2
call fcn.0040b964
lea eax, [ebp - 0x2a0]
mov edx, dword [0x4203a4]
call fcn.0040cff8
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.0040b964
lea eax, [ebp + 8]
call fcn.0040b904
pop eax
jmp eax