Function at 0x659510
Capabilities:
Copy file
Create process on windows
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27e
push 0
push 0
dec ecx
jne 0x659518
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x65933c]
call fcn.0040c8d8
lea eax, [ebp - 0x52]
mov edx, dword [0x61aa64]
call fcn.0040c8d8
xor eax, eax
push ebp
push 0x65cd35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x65cd50
call fcn.00644f14
mov byte [0x68b28a], al
mov byte [0x68b210], 1
mov byte [0x68b20f], 0
mov byte [0x68b20e], 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x400]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f0]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f4]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x404]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x408]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x40c]
call fcn.00551c98
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x410]
call fcn.00551c98
push 0x65cd70
lea eax, [ebp - 0x10e8]
push eax
mov ecx, 0x65cd98
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10e8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
push 0x65cdc8
lea eax, [ebp - 0x10f0]
push eax
mov ecx, 0x65cdf4
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10f0]
lea edx, [ebp - 0x10ec]
call fcn.00647cd4
mov edx, dword [ebp - 0x10ec]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3f8]
call fcn.005516ec
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
xor edx, edx
call fcn.0058e3a4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00551ca0
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
lea edx, [ebp - 0x10f8]
mov eax, dword [0x68b264]
call fcn.00427584
mov eax, dword [ebp - 0x10f8]
lea edx, [ebp - 0x10f4]
call fcn.004313d4
mov edx, dword [ebp - 0x10f4]
mov eax, 0x68b264
call fcn.0040b980
mov dl, 1
mov eax, dword [0x487f74]
call fcn.004b4158
mov dword [0x68b28c], eax
xor eax, eax
mov dword [0x68b294], eax
xor eax, eax
mov dword [0x68b298], eax
xor eax, eax
mov dword [0x68b29c], eax
xor eax, eax
mov dword [0x68b2a0], eax
cmp byte [0x68b281], 0
je 0x65987c
push dword [0x68b264]
push 0x65ce04
lea ecx, [ebp - 0x10fc]
mov edx, 0x65ce14
mov eax, dword [0x68b248]
call fcn.00429244
push dword [ebp - 0x10fc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c414
lea edx, [ebp - 0x1100]
mov eax, dword [ebp - 8]
call fcn.006452ac
mov eax, dword [ebp - 0x1100]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65987c
push 0
lea eax, [ebp - 0x1104]
mov ecx, 0x65ce2c
mov edx, dword [0x68b230]
call fcn.0040c38c
mov eax, dword [ebp - 0x1104]
call fcn.0040c128
push eax
lea edx, [ebp - 0x1108]
mov eax, dword [ebp - 8]
call fcn.006452ac
mov eax, dword [ebp - 0x1108]
call fcn.0040c128
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x65987c
lea eax, [ebp - 0x110c]
mov ecx, 0x65ce2c
mov edx, dword [0x68b230]
call fcn.0040c38c
mov ecx, dword [ebp - 0x110c]
mov dl, 1
mov eax, dword [0x50f328]
call fcn.00512e38
mov dword [0x68b200], eax
mov ecx, dword [0x68b28c]
mov edx, 0x65ce58
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659812
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1110]
mov eax, dword [0x68b28c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1110]
push eax
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00428130
inc eax
mov dword [0x68b29c], eax
mov ecx, dword [0x68b28c]
mov edx, 0x65ce70
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x659872
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x1114]
mov eax, dword [0x68b28c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1114]
push eax
mov eax, dword [0x68b28c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
pop eax
call fcn.00428130
inc eax
mov dword [0x68b2a0], eax
mov eax, dword [0x68b200]
call fcn.004097a0
call fcn.00437ae0
push eax
lea eax, [ebp - 0x1118]
mov ecx, 0x65ce2c
mov edx, dword [0x68b230]
call fcn.0040c38c
mov ecx, dword [ebp - 0x1118]
mov dl, 1
mov eax, dword [0x50f328]
call fcn.00512e7c
mov dword [0x68b200], eax
cmp byte [0x68b281], 0
je 0x65992c
mov eax, 0x65ce9c
call fcn.00644f14
test al, al
jne 0x65992c
mov edx, 0x65cecc
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x6598e8
mov edx, 0x65cecc
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65cf04
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65990a
mov edx, 0x65cf04
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x65cf38
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65992c
mov edx, 0x65cf38
mov eax, dword [0x68b200]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x65cf6c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659964
push 0
mov ecx, 0x65cfa8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
jne 0x659c11
lea edx, [ebp - 0x111c]
mov al, 1
call fcn.00646e48
mov eax, dword [ebp - 0x111c]
push eax
mov ecx, 0x65cfd0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, 0x65d008
call fcn.00644f14
test al, al
jne 0x6599f4
push 0
lea eax, [ebp - 0x1128]
push eax
mov ecx, 0x65d030
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1128]
lea edx, [ebp - 0x1124]
call fcn.00646b2c
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.00647cd4
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, 0x65d030
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x112c]
mov al, 2
call fcn.00646e48
mov eax, dword [ebp - 0x112c]
push eax
mov ecx, 0x65d054
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x1134]
push eax
mov ecx, 0x65d078
mov edx, 0x65d088
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1134]
lea edx, [ebp - 0x1130]
call fcn.00647cd4
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x65d078
mov edx, 0x65d0a8
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 8]
call fcn.0040b590
push 0
mov ecx, 0x65d0c8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659aae
push 0
mov ecx, 0x65d0e4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659aae
lea eax, [ebp - 8]
mov edx, 0x65d0fc
call fcn.0040b9c8
push 0
lea eax, [ebp - 0x1140]
push eax
mov ecx, 0x65cdf4
mov edx, 0x65d088
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1140]
lea edx, [ebp - 0x113c]
call fcn.00647cd4
mov ecx, dword [ebp - 0x113c]
lea eax, [ebp - 0x1138]
mov edx, dword [ebp - 8]
call fcn.0040c38c
mov eax, dword [ebp - 0x1138]
push eax
mov ecx, 0x65cdf4
mov edx, 0x65d0a8
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x60], 2
push 0
lea eax, [ebp - 0x1148]
push eax
lea edx, [ebp - 0x114c]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x114c]
mov edx, 0x65d088
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1148]
lea edx, [ebp - 0x1144]
call fcn.00647cd4
mov eax, dword [ebp - 0x1144]
push eax
lea edx, [ebp - 0x1150]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1150]
mov edx, 0x65d0a8
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xb
jne 0x659b12
push 0
mov ecx, 0x65d1b8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x659c11
xor eax, eax
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x1158]
push eax
lea edx, [ebp - 0x115c]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x115c]
mov edx, 0x65d1b8
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1158]
lea edx, [ebp - 0x1154]
call fcn.00647cd4
mov eax, dword [ebp - 0x1154]
push eax
lea edx, [ebp - 0x1160]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1160]
mov edx, 0x65d1b8
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x22
jne 0x659ba1
push 0
lea eax, [ebp - 0x116c]
push eax
mov ecx, 0x65d1d4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x116c]
lea edx, [ebp - 0x1168]
call fcn.00646b2c
mov eax, dword [ebp - 0x1168]
lea edx, [ebp - 0x1164]
call fcn.00647cd4
mov eax, dword [ebp - 0x1164]
push eax
mov ecx, 0x65d1d4
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x68b20b]
push eax
mov ecx, 0x65d1ec
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68b205]
push eax
mov ecx, 0x65d20c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
movzx eax, byte [0x68b207]
push eax
mov ecx, 0x65d224
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, dword [0x68b264]
push eax
mov ecx, 0x65d238
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x68b281], 0
je 0x659d0e
mov ecx, 0x65d25c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x659d0e
mov ecx, 0x65d25c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
cmp dword [0x68b268], 0
je 0x659d31
mov eax, dword [0x68b268]
push eax
mov ecx, 0x65d288
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov byte [ebp - 0x75], 0
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x659e14
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x418]
mov ecx, dword [eax + 0x2c0]
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [0x68b1c4]
mov eax, dword [eax + 0x418]
mov edx, dword [eax]
call dword [edx + 0x16c]
dec eax
test eax, eax
jl 0x659e14
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1174]
push eax
lea edx, [ebp - 0x1178]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1178]
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1174]
lea edx, [ebp - 0x1170]
call fcn.0042717c
mov eax, dword [ebp - 0x1170]
mov dword [ebp - 0x94], eax
mov ecx, 1
mov edx, dword [ebp - 0x94]
mov eax, 0x65d2c4
call fcn.0040c658
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jle 0x659e09
mov byte [ebp - 0x75], 1
jmp 0x659e14
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x659d96
cmp byte [ebp - 0x75], 0
je 0x659e34
mov eax, dword [0x68b26c]
push eax
mov ecx, 0x65d2ec
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp byte [0x68b208], 0
je 0x65a476
cmp byte [0x68b206], 0
je 0x659e70
mov eax, 0x65d318
call fcn.00644f14
test al, al
je 0x659e70
push 1
mov ecx, 0x65d340
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x659e9b
push 0
mov ecx, 0x65d364
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65d340
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d390
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65d390
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d390
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a099
mov edx, 0x65d3b8
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0x99]
cmp byte [ebp - 0x99], 0
je 0x659f0e
mov byte [ebp - 0x9b], 1
jmp 0x659f33
mov edx, 0x65d3cc
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0x9a]
movzx eax, byte [ebp - 0x9a]
mov byte [ebp - 0x9b], al
cmp byte [ebp - 0x9b], 0
je 0x659f45
mov byte [ebp - 0x9d], 1
jmp 0x659f6a
mov edx, 0x65d3f0
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0x9c]
movzx eax, byte [ebp - 0x9c]
mov byte [ebp - 0x9d], al
cmp byte [ebp - 0x9d], 0
je 0x659f7c
mov byte [ebp - 0x9f], 1
jmp 0x659fa1
mov edx, 0x65d424
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0x9e]
movzx eax, byte [ebp - 0x9e]
mov byte [ebp - 0x9f], al
cmp byte [ebp - 0x9f], 0
je 0x659fb3
mov byte [ebp - 0xa1], 1
jmp 0x659fd8
mov edx, 0x65d454
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0xa0]
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0xa1], al
cmp byte [ebp - 0xa1], 0
je 0x659fea
mov byte [ebp - 0xaa], 1
jmp 0x65a029
lea edx, [ebp - 0x117c]
mov al, 0x15
call fcn.00646e48
mov eax, dword [ebp - 0x117c]
mov dword [ebp - 0xa8], eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0xa9]
movzx eax, byte [ebp - 0xa9]
mov byte [ebp - 0xaa], al
cmp byte [ebp - 0xaa], 0
je 0x65a03b
mov byte [ebp - 0xb2], 1
jmp 0x65a07a
lea edx, [ebp - 0x1180]
mov al, 0x16
call fcn.00646e48
mov eax, dword [ebp - 0x1180]
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov eax, dword [0x68b264]
call fcn.0042731c
test eax, eax
sete byte [ebp - 0xb1]
movzx eax, byte [ebp - 0xb1]
mov byte [ebp - 0xb2], al
cmp byte [ebp - 0xb2], 0
je 0x65a099
push 0
mov ecx, 0x65d390
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d490
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65d490
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d4c0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a129
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x65d4f0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.00647cd4
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x65d4f0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x65a13f
push 0
mov ecx, 0x65d4f0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65d530
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a1b5
push 0
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x65d564
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1194]
lea edx, [ebp - 0x1190]
call fcn.00646b2c
mov eax, dword [ebp - 0x1190]
lea edx, [ebp - 0x118c]
call fcn.00647cd4
mov eax, dword [ebp - 0x118c]
push eax
mov ecx, 0x65d564
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x65a1cb
push 0
mov ecx, 0x65d564
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65d58c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65d58c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d5b4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a2d3
push 0
lea eax, [ebp - 0x119c]
push eax
mov ecx, 0x65d5e4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x119c]
lea edx, [ebp - 0x1198]
call fcn.00647cd4
mov eax, dword [ebp - 0x1198]
push eax
mov ecx, 0x65d61c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x11a4]
push eax
mov ecx, 0x65d63c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11a4]
lea edx, [ebp - 0x11a0]
call fcn.00647cd4
mov eax, dword [ebp - 0x11a0]
push eax
mov ecx, 0x65d674
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65d69c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65d6d8
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65a2ff
mov ecx, 0x65d61c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65a2ff
mov ecx, 0x65d61c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65d700
call fcn.00644f14
push eax
mov ecx, 0x65d72c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65d754
call fcn.00644f14
push eax
mov ecx, 0x65d784
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65d7b4
call fcn.00644f14
push eax
mov ecx, 0x65d7e8
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov eax, 0x65d818
call fcn.00644f14
test al, al
je 0x65a382
push 1
mov ecx, 0x65d848
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65a3ae
mov ecx, 0x65d848
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65a3ae
mov ecx, 0x65d848
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65d878
call fcn.00644f14
test al, al
je 0x65a3d4
push 1
mov ecx, 0x65d8ac
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65a400
mov ecx, 0x65d8ac
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65a400
mov ecx, 0x65d8ac
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65d8e0
call fcn.00644f14
test al, al
je 0x65a426
push 1
mov ecx, 0x65d91c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65a452
mov ecx, 0x65d91c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x70]
test al, al
je 0x65a452
mov ecx, 0x65d91c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, 0x65d954
call fcn.00644f14
test al, al
je 0x65a476
push 1
mov ecx, 0x65d97c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65d1b8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a7f8
push 0
lea eax, [ebp - 0x11ac]
push eax
mov ecx, 0x65d99c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11ac]
lea edx, [ebp - 0x11a8]
call fcn.00647cd4
mov eax, dword [ebp - 0x11a8]
push eax
mov ecx, 0x65d99c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
mov ecx, 0x65d9bc
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65d9bc
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65d9e0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a7f8
push 1
mov ecx, 0x65d9e0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65da08
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65da08
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65da38
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65da38
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65da68
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65da68
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65da90
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65da90
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65dac4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65dac4
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65dac4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a68a
push 0xffffffffffffffff
mov ecx, 0x65daf0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65daf0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65db1c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a6a0
push 1
mov ecx, 0x65db1c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
jmp 0x65a6a0
push 0
mov ecx, 0x65daf0
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
mov ecx, 0x65db4c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a6d0
push 1
mov ecx, 0x65db4c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65db80
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
push eax
mov ecx, 0x65db80
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x24]
push 0
mov ecx, 0x65db80
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65a740
push 0
mov ecx, 0x65dbbc
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push eax
mov ecx, 0x65dbbc
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push 0
lea eax, [ebp - 0x11b4]
push eax
mov ecx, 0x65dbec
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11b0]
call fcn.00647cd4
mov eax, dword [ebp - 0x11b0]
push eax
mov ecx, 0x65dbec
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
lea eax, [ebp - 0x11b8]
push eax
mov ecx, 0x65dc1c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x11b8], 0
je 0x65a7f8
push 0
lea eax, [ebp - 0x11c0]
push eax
mov ecx, 0x65dc1c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x11c0]
lea edx, [ebp - 0x11bc]
call fcn.00647cd4
mov eax, dword [ebp - 0x11bc]
push eax
mov ecx, 0x65dc1c
mov edx, 0x65cfec
mov eax, dword [0x68b200]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0x65dc4c
lea eax, [ebp - 0x11c4]
push eax
mov ecx, 0x65dc80
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11c4]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
push 0x1f4
call sub.kernel32.dll_Sleep
xor eax, eax
push ebp
push 0x65a8c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x11c8]
xor eax, eax
call fcn.00407540
mov ecx, dword [ebp - 0x11c8]
mov dl, 1
mov eax, dword [0x48b22c]
call fcn.004b642c
mov dword [0x68b1c8], eax
mov eax, dword [0x68b1f0]
xor edx, edx
push edx
push eax
mov eax, dword [0x68b1c8]
call fcn.004b438c
push 0xff00
lea eax, [ebp - 0x11cc]
mov ecx, 0x65dc94
mov edx, dword [0x68b230]
call fcn.0040c38c
mov ecx, dword [ebp - 0x11cc]
mov dl, 1
mov eax, dword [0x48b22c]
call fcn.004b642c
mov dword [0x68b1cc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65a919
xor esi, esi
mov eax, dword [0x68b1f4]
sub eax, esi
cmp eax, 0x1000
jb 0x65a942
lea edx, [ebp - 0x10e4]
mov ecx, 0x1000
mov eax, dword [0x68b1c8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x65a95c
mov ecx, dword [0x68b1f4]
sub ecx, esi
lea edx, [ebp - 0x10e4]
mov eax, dword [0x68b1c8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x10e4]
mov ecx, ebx
mov eax, dword [0x68b1cc]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x68b1f4]
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11d0], eax
fild qword [ebp - 0x11d4]
fdivr dword [0x65dcb4]
mov dword [ebp - 0x11d4], esi
xor eax, eax
mov dword [ebp - 0x11d0], eax
fild qword [ebp - 0x11d4]
fmulp st(1)
call fcn.00407bd0
mov edx, eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058e3a4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.00551ce0
cmp ebx, 0x1000
je 0x65a91b
mov eax, dword [0x68b1cc]
call fcn.004097a0
mov eax, dword [0x68b1c8]
call fcn.004097a0
push 0x65dcc4
lea eax, [ebp - 0x11d8]
push eax
mov ecx, 0x65dcf4
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x11d8]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov dl, 1
mov eax, dword [0x61b1b8]
call fcn.006220bc
mov dword [0x68b1d0], eax
xor eax, eax
push ebp
push 0x65aa79
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11dc]
mov ecx, 0x65dc94
mov edx, dword [0x68b230]
call fcn.0040c38c
mov edx, dword [ebp - 0x11dc]
mov cl, 1
mov eax, dword [0x68b1d0]
call fcn.00622170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65aacd
mov dl, 1
mov eax, dword [0x487f74]
call fcn.004b4158
mov dword [ebp - 4], eax
mov byte [ebp - 0x7d], 0
push 0
mov ecx, 0x65dd04
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, 0x65dd28
call fcn.00644f14
xor al, 1
mov byte [ebp - 0x79], al
mov eax, 0x65dd50
call fcn.00644f14
xor al, 1
mov byte [ebp - 0x7b], al
mov eax, 0x65dd78
call fcn.00644f14
mov byte [ebp - 0x7a], al
mov eax, 0x65dda4
call fcn.00644f14
mov byte [0x68b20d], al
mov eax, 0x65ddcc
call fcn.00644f14
xor al, 1
mov byte [0x68b287], al
mov eax, 0x65de00
call fcn.00644f14
xor al, 1
mov byte [0x68b288], al
mov eax, 0x65de28
call fcn.00644f14
mov byte [0x68b289], al
mov eax, 0x65de58
call fcn.00644f14
mov byte [ebp - 0x7c], al
mov byte [0x68b212], 0
mov byte [0x68b213], 0
lea eax, [ebp - 0x10]
call fcn.0040b590
push 0
mov ecx, 0x65de90
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68b218], eax
push 0
mov ecx, 0x65deb4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [0x68b21c], eax
mov eax, dword [0x68325c]
mov eax, dword [eax]
mov eax, dword [eax + 0x424]
cmp byte [eax + 0x69], 0
je 0x65aceb
mov eax, dword [0x68325c]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov eax, dword [eax + 0x2c0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65aceb
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
mov eax, dword [0x68325c]
mov eax, dword [eax]
mov eax, dword [eax + 0x428]
mov edx, dword [ebp - 0x60]
call fcn.0063f408
test al, al
jne 0x65acdc
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 0x60]
call fcn.006590a8
cmp dword [ebp - 8], 0
je 0x65acdc
lea edx, [ebp - 0x11e0]
mov eax, dword [ebp - 8]
call fcn.0042717c
mov edx, dword [ebp - 0x11e0]
lea eax, [ebp - 8]
call fcn.0040b9c8
mov eax, dword [ebp - 8]
mov edx, 0x65ded8
call fcn.0040c4c4
jne 0x65ac6e
mov byte [0x68b212], 1
jmp 0x65acdc
mov eax, dword [ebp - 8]
mov edx, 0x65defc
call fcn.0040c4c4
jne 0x65ac86
mov byte [0x68b213], 1
jmp 0x65acdc
mov eax, dword [ebp - 8]
mov edx, 0x65df20
call fcn.0040c4c4
jne 0x65aca5
mov byte [0x68b212], 1
mov byte [0x68b213], 1
jmp 0x65acdc
mov eax, dword [ebp - 8]
mov edx, 0x65df40
call fcn.0040c4c4
jne 0x65acc4
mov byte [0x68b212], 1
mov byte [0x68b213], 1
jmp 0x65acdc
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x65df64
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040c414
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65ac03
cmp dword [ebp - 0x10], 0
setne byte [ebp - 0x77]
push 0xffffffffffffffff
mov ecx, 0x65df74
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
dec eax
test eax, eax
jl 0x65bcbe
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68b20f], 0
je 0x65ad8a
cmp dword [ebp - 0x74], 0xffffffff
je 0x65ad79
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x11e4]
mov eax, dword [ebp - 0x74]
call fcn.00427e9c
mov eax, dword [ebp - 0x11e4]
push eax
lea eax, [ebp - 0x11e8]
mov ecx, 0x65dfa0
mov edx, dword [0x68b230]
call fcn.0040c38c
mov ecx, dword [ebp - 0x11e8]
mov eax, dword [0x68b1d0]
pop edx
call fcn.006232f8
mov eax, dword [0x68b1d0]
call fcn.004097a0
push ebp
call fcn.006593a0
pop ecx
cmp byte [0x68b212], 0
je 0x65ada2
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68b218]
jl 0x65bcaf
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11ec]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x11ec]
mov edx, 0x65ce58
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 8], 0
jne 0x65add5
mov al, 1
jmp 0x65adf7
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65dfcc
call fcn.0040c658
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
sete al
test al, al
jne 0x65bcaf
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65dfcc
call fcn.0040c658
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xbc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c4fc
cmp byte [0x68b213], 0
je 0x65ae8b
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x68b218]
jl 0x65ae8b
mov eax, dword [ebp - 0x1c]
mov edx, 0x65dfdc
call fcn.0040c4c4
je 0x65ae8b
mov eax, dword [ebp - 0x1c]
mov edx, 0x65e01c
call fcn.0040c4c4
je 0x65ae8b
lea eax, [ebp - 0x11f0]
mov ecx, dword [0x68b248]
mov edx, 0x65e060
call fcn.0040c38c
mov edx, dword [ebp - 0x11f0]
mov eax, dword [ebp - 0x1c]
call fcn.0040c4c4
jne 0x65bcaf
cmp byte [ebp - 0x77], 0
je 0x65af6c
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.0040b9c8
jmp 0x65af46
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65df64
call fcn.0040c658
mov esi, eax
lea eax, [ebp - 0x11f4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040c4fc
mov edi, dword [ebp - 0x11f4]
lea edx, [ebp - 0x11f8]
mov eax, dword [ebp - 0x1c]
call fcn.0042717c
mov eax, dword [ebp - 0x11f8]
mov dword [ebp - 0xc0], eax
mov ecx, 1
mov edx, dword [ebp - 0xc0]
mov eax, edi
call fcn.0040c658
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jle 0x65af1b
mov byte [ebp - 0x78], 1
jmp 0x65af62
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65df64
call fcn.0040c658
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0xc8]
mov edx, 1
call fcn.0040c544
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x65df64
call fcn.0040c658
mov ebx, eax
test ebx, ebx
jg 0x65aea9
cmp byte [ebp - 0x78], 0
jne 0x65bcaf
lea edx, [ebp - 0x11fc]
mov eax, dword [ebp - 0x1c]
call fcn.00647cd4
mov edx, dword [ebp - 0x11fc]
lea eax, [ebp - 0x1c]
call fcn.0040b9c8
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65dfcc
call fcn.0040c658
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xcc]
mov edx, 1
call fcn.0040c544
cmp dword [ebp - 0x1c], 0
jne 0x65afbd
mov al, 1
jmp 0x65afcf
mov eax, dword [ebp - 8]
test eax, eax
je 0x65afc9
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
setl al
test al, al
jne 0x65bcaf
lea eax, [ebp - 0x1200]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.0040c148
mov eax, dword [ebp - 0x1200]
mov edx, 1
call fcn.00428130
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 8]
cmp word [eax + 2], 0x31
sete al
mov byte [ebp - 0x17], al
xor eax, eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65b01a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65b327
fild dword [ebp - 0x6c]
fdivr dword [0x65e07c]
fild dword [ebp - 0x60]
fmulp st(1)
call fcn.00407bd0
mov edx, eax
add edx, 0x1e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
call fcn.0058e3a4
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
lea edx, [ebp - 0x1204]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x1204]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65b327
movzx eax, byte [ebp - 0x17]
and al, byte [ebp - 0x7c]
je 0x65b08b
mov byte [ebp - 0x17], 0
cmp byte [ebp - 0x18], 0
jne case.0x65b104.0
cmp byte [0x68b206], 0
je 0x65b0a7
mov byte [ebp - 0x18], 1
jmp case.0x65b104.0
cmp byte [ebp - 0x7d], 0
jne 0x65b158
push 0
push 0
lea eax, [ebp - 0x120c]
push eax
mov ecx, 0x65cd98
mov edx, 0x65d0a8
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x120c]
lea ecx, [ebp - 0x1208]
mov edx, dword [ebp - 0x1c]
call fcn.00649504
mov eax, dword [ebp - 0x1208]
movzx ecx, word [0x65e080]
xor edx, edx
call fcn.005a250c
cmp eax, 0xe
ja case.0x65b104.0
movzx eax, byte [eax + 0x65b10b]
jmp dword [eax*4 + 0x65b11a]
mov byte [ebp - 0x18], 1
jmp case.0x65b104.0
mov byte [ebp - 0x18], 3
jmp case.0x65b104.0
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x7d], 1
jmp case.0x65b104.0
mov byte [ebp - 0x18], 3
mov byte [ebp - 0x7d], 3
jmp case.0x65b104.0
mov byte [ebp - 0x18], 3
jmp case.0x65b104.0
movzx eax, byte [ebp - 0x7d]
mov byte [ebp - 0x18], al
cmp byte [ebp - 0x18], 2
jne 0x65b253
xor eax, eax
push ebp
push 0x65b245
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x52]
mov edx, dword [ebp - 0x60]
mov eax, dword [0x68b1d0]
call fcn.00620afc
mov eax, dword [ebp - 0x4a]
mov dword [ebp - 0x5c], eax
push 0
lea edx, [ebp - 0x1210]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov edx, dword [ebp - 0x1210]
mov ecx, dword [0x68b230]
mov eax, dword [0x68b1d0]
call fcn.006228d8
push dword [0x68b230]
push 0x65ce04
lea edx, [ebp - 0x1218]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
push dword [ebp - 0x1218]
lea eax, [ebp - 0x1214]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x1214]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
call fcn.00658cd4
test al, al
je 0x65b1fd
mov byte [ebp - 0x18], 1
jmp 0x65b201
mov byte [ebp - 0x18], 3
push dword [0x68b230]
push 0x65ce04
lea edx, [ebp - 0x1220]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
push dword [ebp - 0x1220]
lea eax, [ebp - 0x121c]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x121c]
call fcn.00429104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b253
cmp byte [ebp - 0x18], 1
jne 0x65b302
xor eax, eax
push ebp
push 0x65b2f8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x68b20d], 0
je 0x65b2d5
push 0
push dword [0x68b230]
push 0x65ce04
lea edx, [ebp - 0x1228]
mov eax, dword [ebp - 0x1c]
call fcn.00429488
push dword [ebp - 0x1228]
push 0x65e090
lea eax, [ebp - 0x1224]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x1224]
call fcn.0040c128
push eax
lea edx, [ebp - 0x122c]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x122c]
call fcn.0040c128
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1230]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x1230]
call fcn.00429104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b302
cmp byte [ebp - 0x18], 3
jne 0x65b327
mov eax, 0x65e0b0
call fcn.00644f14
test al, al
jne 0x65bcaf
mov eax, dword [ebp - 0x1c]
call fcn.00658ec4
jmp 0x65bcaf
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x65b333
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x1c]
cmp word [eax + ebx*2 - 2], 0x5c
je 0x65b372
lea edx, [ebp - 0x1238]
mov eax, dword [ebp - 0x1c]
call fcn.00429364
mov eax, dword [ebp - 0x1238]
lea edx, [ebp - 0x1234]
call fcn.006452ac
mov eax, dword [ebp - 0x1234]
mov dl, 1
call fcn.00428bd8
test al, al
jne 0x65b7f0
mov dword [ebp - 0x70], 4
lea eax, [ebp - 0x123c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c4fc
mov eax, dword [ebp - 0x123c]
mov edx, 0x65e0e0
call fcn.0040c4c4
jne 0x65b405
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x65b3c7
mov eax, dword [ebp - 0xd0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xd0]
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x1c]
call fcn.0040c4fc
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x65ce04
call fcn.0040c658
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
add eax, 3
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x65b435
mov eax, dword [ebp - 0xdc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0xdc]
sub edx, eax
jl 0x65b7e6
inc edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x65b7d7
lea eax, [ebp - 0x1244]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c4fc
mov eax, dword [ebp - 0x1244]
lea edx, [ebp - 0x1240]
call fcn.006452ac
mov eax, dword [ebp - 0x1240]
mov dl, 1
call fcn.00428bd8
test al, al
jne 0x65b7d7
xor edx, edx
push ebp
push 0x65b52e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x124c]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c4fc
mov eax, dword [ebp - 0x124c]
lea edx, [ebp - 0x1248]
call fcn.006452ac
mov eax, dword [ebp - 0x1248]
call fcn.004072f0
call fcn.00407178
cmp byte [0x68b208], 0
je 0x65b521
cmp byte [ebp - 0x17], 0
je 0x65b521
lea eax, [ebp - 0x1250]
push eax
mov ecx, dword [ebp - 0x64]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x1c]
call fcn.0040c4fc
mov edx, dword [ebp - 0x1250]
mov eax, 0x65e0f4
call fcn.0064b208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b7d7
inc dword [ebp - 0x64]
dec dword [ebp - 0x90]
jne 0x65b453
cmp byte [ebp - 0x75], 0
jne 0x65bcaf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x65b7fc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x65bcaf
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x1290]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65b9b7
lea edx, [ebp - 0x1298]
mov eax, dword [ebp - 0x1c]
call fcn.004294e4
mov eax, dword [ebp - 0x1298]
lea edx, [ebp - 0x1294]
call fcn.0042717c
mov eax, dword [ebp - 0x1294]
mov edx, 0x65e210
call fcn.0040c4c4
jne 0x65b8c1
mov eax, dword [ebp - 0x1c]
call fcn.00644c68
test al, al
je 0x65b8c1
push 0
push 0
push 0x65e228
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 0x1c]
call fcn.00429488
push dword [ebp - 0x12a0]
push 0x65e25c
lea eax, [ebp - 0x129c]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x129c]
call fcn.0040c128
push eax
push 0x65e264
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x12a4]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12a4]
mov dl, 1
call fcn.00428e38
test eax, 1
jle 0x65b926
xor eax, eax
push ebp
push 0x65b91c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x12a8]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12a8]
mov cl, 1
mov edx, 0x80
call fcn.00428ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65b926
lea edx, [ebp - 0x12b0]
mov eax, dword [ebp - 0x1c]
call fcn.004294e4
mov eax, dword [ebp - 0x12b0]
lea edx, [ebp - 0x12ac]
call fcn.0042717c
mov eax, dword [ebp - 0x12ac]
mov edx, 0x65e280
call fcn.0040c4c4
je 0x65b988
lea edx, [ebp - 0x12b8]
mov eax, dword [ebp - 0x1c]
call fcn.004294e4
mov eax, dword [ebp - 0x12b8]
lea edx, [ebp - 0x12b4]
call fcn.0042717c
mov eax, dword [ebp - 0x12b4]
mov edx, 0x65e298
call fcn.0040c4c4
jne 0x65b9b7
lea edx, [ebp - 0x12bc]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12bc]
call fcn.00658dc0
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov byte [ebp - 0x76], 0
lea edx, [ebp - 0x12c0]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12c0]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65ba15
xor eax, eax
push ebp
push 0x65ba0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x12c4]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12c4]
call fcn.00429104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65ba15
xor eax, eax
push ebp
push 0x65ba75
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
movzx eax, byte [ebp - 0x7a]
push eax
movzx eax, byte [ebp - 0x79]
push eax
movzx eax, byte [ebp - 0x7b]
push eax
lea edx, [ebp - 0x12c8]
mov eax, dword [ebp - 0x1c]
call fcn.006452ac
mov eax, dword [ebp - 0x12c8]
push eax
lea edx, [ebp - 0x12cc]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov edx, dword [ebp - 0x12cc]
mov eax, dword [0x68b1d0]
pop ecx
call fcn.006232f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bc62
cmp byte [ebp - 0x76], 0
jne 0x65b9b7
cmp byte [ebp - 0x7a], 0
je 0x65bc7a
mov eax, dword [ebp - 0x1c]
call fcn.0065925c
cmp byte [0x68b208], 0
je 0x65bc96
cmp byte [ebp - 0x17], 0
je 0x65bc96
mov edx, dword [ebp - 0x1c]
mov eax, 0x65ce58
call fcn.0064b208
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
cmp dword [ebp - 0x6c], 0x32
jge 0x65bcaf
push 0x64
call sub.kernel32.dll_Sleep
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65ad26
xor eax, eax
push ebp
push 0x65bcea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b1d0]
call fcn.006222e4
mov eax, dword [0x68b1d0]
call fcn.004097a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65bcf4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
mov edx, 0x63
call fcn.0058e3a4
push 0x65e428
lea eax, [ebp - 0x12f0]
push eax
mov ecx, 0x65e45c
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x12f0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65bdcf
mov ecx, dword [ebp - 4]
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65bdcf
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x12f4]
push eax
lea edx, [ebp - 0x12f8]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x12f8]
mov edx, 0x65d2a4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x12f4]
call fcn.0064ec60
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65bd8d
cmp byte [0x68b208], 0
je 0x65be27
cmp byte [0x68b281], 0
jne 0x65be27
push dword [0x68b264]
push 0x65ce04
lea ecx, [ebp - 0x1300]
mov edx, 0x65ce14
mov eax, dword [0x68b248]
call fcn.00429244
push dword [ebp - 0x1300]
lea eax, [ebp - 0x12fc]
mov edx, 3
call fcn.0040c414
mov edx, dword [ebp - 0x12fc]
mov eax, 0x65ce58
call fcn.0064b208
push 0
mov ecx, 0x65d0e4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65c865
push 0
mov ecx, 0x65e470
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jle 0x65bf66
push 0x65dc4c
lea eax, [ebp - 0x1304]
push eax
mov ecx, 0x65dc80
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1304]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
cmp byte [0x68b206], 0
je 0x65beb7
mov word [ebp - 0x86], 0
jmp 0x65bec0
mov word [ebp - 0x86], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x65e494
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0xc], 0
jne 0x65beed
lea eax, [ebp - 0xc]
mov edx, 0x65e4c4
call fcn.0040b9c8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x65bf10
mov eax, dword [ebp - 0xe0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jle 0x65bf66
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x65bf66
mov word [ebp - 0x86], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x65bf4e
mov eax, dword [ebp - 0xe4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xe4]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040c4fc
push 0
mov ecx, 0x65e470
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
je 0x65bf8b
dec eax
je 0x65c0ba
jmp 0x65c277
push 0
lea eax, [ebp - 0x130c]
push eax
mov ecx, 0x65e4fc
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov ecx, dword [ebp - 0x130c]
lea eax, [ebp - 0x1308]
mov edx, 0x65e524
call fcn.0040c38c
mov eax, dword [ebp - 0x1308]
lea edx, [ebp - 8]
call fcn.00647cd4
lea edx, [ebp - 0x1310]
mov eax, dword [ebp - 8]
call fcn.006452ac
mov eax, dword [ebp - 0x1310]
mov dl, 1
call fcn.00428b40
test al, al
jne 0x65bff9
lea eax, [ebp - 8]
mov edx, dword [0x68b238]
call fcn.0040b9c8
lea edx, [ebp - 0x1314]
mov eax, dword [ebp - 8]
call fcn.006452ac
mov eax, dword [ebp - 0x1314]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65c0ae
lea edx, [ebp - 0x1318]
mov eax, 0x65e54c
call fcn.00647cd4
mov eax, dword [ebp - 0x1318]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65c0ae
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 1
push 0x65e588
push dword [ebp - 8]
push 0x65e59c
push dword [ebp - 0xc]
lea eax, [ebp - 0x1320]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x1320]
lea edx, [ebp - 0x131c]
call fcn.00647cd4
mov eax, dword [ebp - 0x131c]
push eax
lea edx, [ebp - 0x1324]
mov eax, 0x65e54c
call fcn.00647cd4
mov eax, dword [ebp - 0x1324]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b2f8
pop edx
pop ecx
call fcn.00645eb4
jmp 0x65c277
mov byte [0x68b20e], 1
jmp 0x65c277
push 0
lea eax, [ebp - 0x1328]
push eax
mov ecx, 0x65e4fc
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1328]
lea edx, [ebp - 8]
call fcn.00647cd4
cmp dword [ebp - 8], 0
je 0x65c270
lea edx, [ebp - 0x132c]
mov eax, dword [ebp - 8]
call fcn.00659028
cmp dword [ebp - 0x132c], 0
je 0x65c270
lea edx, [ebp - 0x1330]
mov eax, 0x65e5b0
call fcn.00647cd4
mov eax, dword [ebp - 0x1330]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65c270
push 1
push 1
push 0
push 1
push 0x65e5f8
push dword [ebp - 8]
push 0x65e610
lea edx, [ebp - 0x133c]
mov eax, dword [ebp - 8]
call fcn.00659028
push dword [ebp - 0x133c]
push 0x65e648
lea eax, [ebp - 0x1338]
mov edx, 5
call fcn.0040c414
mov eax, dword [ebp - 0x1338]
lea edx, [ebp - 0x1334]
call fcn.00647cd4
mov eax, dword [ebp - 0x1334]
push eax
lea edx, [ebp - 0x1340]
mov eax, 0x65e5b0
call fcn.00647cd4
mov eax, dword [ebp - 0x1340]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b2f8
pop edx
pop ecx
call fcn.00645eb4
test al, al
je 0x65c267
mov eax, dword [0x68b234]
mov edx, 0x65dcf4
call fcn.0040c4c4
je 0x65c25e
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
movzx eax, word [ebp - 0x86]
push eax
push 1
push 0
push 1
push 0x65e658
lea edx, [ebp - 0x134c]
mov eax, dword [ebp - 8]
call fcn.00659028
push dword [ebp - 0x134c]
push 0x65e59c
push dword [ebp - 0xc]
lea eax, [ebp - 0x1348]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x1348]
lea edx, [ebp - 0x1344]
call fcn.00647cd4
mov eax, dword [ebp - 0x1344]
push eax
lea edx, [ebp - 0x1350]
mov eax, 0x65e54c
call fcn.00647cd4
mov eax, dword [ebp - 0x1350]
push eax
mov eax, dword [ebp - 0x58]
call fcn.0055b2f8
pop edx
pop ecx
call fcn.00645eb4
test al, al
jne 0x65c277
mov byte [0x68b20e], 1
jmp 0x65c277
mov byte [0x68b20e], 1
jmp 0x65c277
mov byte [0x68b20e], 1
jmp 0x65c277
mov byte [0x68b20e], 1
mov eax, dword [0x68325c]
mov eax, dword [eax]
mov eax, dword [eax + 0x40c]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x65c362
push 0x65e68c
lea eax, [ebp - 0x1354]
push eax
mov ecx, 0x65e6cc
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1354]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov ecx, dword [ebp - 4]
mov edx, 0x65e6dc
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x65c346
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1358]
push eax
lea ecx, [ebp - 0x135c]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x135c]
mov edx, 0x65e6dc
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1358]
call fcn.0065092c
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c301
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov edx, 0x65e700
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65c42f
push 0x65e720
lea eax, [ebp - 0x1360]
push eax
mov ecx, 0x65e768
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1360]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov ecx, dword [ebp - 4]
mov edx, 0x65e700
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c42f
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
cmp byte [0x68b20f], 0
jne 0x65c42f
push 0
lea eax, [ebp - 0x1364]
push eax
lea edx, [ebp - 0x1368]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1368]
mov edx, 0x65e700
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1364]
call fcn.0064dbd4
test al, al
je 0x65c42f
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c3e0
push 0x65e428
lea eax, [ebp - 0x136c]
push eax
mov ecx, 0x65e45c
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x136c]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov eax, 0x68b24c
call fcn.0040b590
mov edx, 0x65e778
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65c501
mov ecx, dword [ebp - 4]
mov edx, 0x65e778
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c501
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1370]
push eax
lea edx, [ebp - 0x1374]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1374]
mov edx, 0x65e778
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1370]
call fcn.00650244
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c4bf
push 0
mov ecx, 0x65dac4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65c578
push 0xffffffffffffffff
mov ecx, 0x65daf0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
test eax, eax
jne 0x65c578
cmp byte [0x68b20b], 0
je 0x65c54d
lea eax, [ebp - 8]
mov edx, 0x65e78c
call fcn.0040b9c8
jmp 0x65c55a
lea eax, [ebp - 8]
mov edx, 0x65e7b8
call fcn.0040b9c8
lea eax, [ebp - 0x1378]
mov ecx, 0x65e7e4
mov edx, dword [ebp - 8]
call fcn.0040c38c
mov eax, dword [ebp - 0x1378]
call fcn.0064dbd4
mov eax, dword [0x68325c]
mov eax, dword [eax]
mov eax, dword [eax + 0x410]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x65c5e4
cmp byte [0x68b20b], 0
je 0x65c5a9
lea eax, [ebp - 8]
mov edx, 0x65e78c
call fcn.0040b9c8
jmp 0x65c5b6
lea eax, [ebp - 8]
mov edx, 0x65e7b8
call fcn.0040b9c8
push dword [ebp - 8]
push 0x65e8d4
push dword [0x68b268]
push 0x65e954
lea eax, [ebp - 0x137c]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x137c]
call fcn.0064dbd4
mov edx, 0x65e988
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65c6b3
mov ecx, dword [ebp - 4]
mov edx, 0x65e988
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c670
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1380]
push eax
lea edx, [ebp - 0x1384]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1384]
mov edx, 0x65e988
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1380]
call fcn.006517a0
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c62e
xor eax, eax
push ebp
push 0x65c6a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
push eax
push 0x1388
push 2
push 0x65e9a4
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65c6b3
mov edx, 0x65e9c8
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65c73b
mov ecx, dword [ebp - 4]
mov edx, 0x65e9c8
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c73b
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1388]
push eax
lea edx, [ebp - 0x138c]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x138c]
mov edx, 0x65e9c8
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1388]
call fcn.00653854
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c6f9
mov edx, 0x65e9e4
mov eax, dword [0x68b1f8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x65c865
mov ecx, dword [ebp - 4]
mov edx, 0x65e9e4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x50]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x65c865
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x1390]
push eax
lea edx, [ebp - 0x1394]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x1394]
mov edx, 0x65e9e4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1390]
mov ax, 5
call fcn.0065580c
cmp byte [0x68b284], 0
je 0x65c7db
mov byte [0x68b20e], 1
push ebp
call fcn.006593a0
pop ecx
push 0
lea eax, [ebp - 0x1398]
push eax
lea edx, [ebp - 0x139c]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x139c]
mov edx, 0x65e9e4
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x1398]
mov ax, 6
call fcn.0065580c
push 0x65e428
lea eax, [ebp - 0x13a0]
push eax
mov ecx, 0x65e45c
mov edx, 0x65cdac
mov eax, dword [0x68b1fc]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x13a0]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x3ec]
call fcn.005516ec
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
inc dword [ebp - 0x60]
dec dword [ebp - 0x8c]
jne 0x65c789
cmp dword [0x68b268], 0
je 0x65c9d6
lea edx, [ebp - 0x13a4]
mov eax, dword [0x68b268]
call fcn.006452ac
mov eax, dword [ebp - 0x13a4]
mov dl, 1
call fcn.00428b40
test al, al
je 0x65c9d6
push 0
mov ecx, 0x65ea04
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65c944
lea edx, [ebp - 0x13a8]
mov eax, dword [0x68b268]
call fcn.00429488
mov ecx, dword [ebp - 0x13a8]
lea eax, [ebp - 8]
mov edx, 0x65ea30
call fcn.0040c38c
push dword [ebp - 8]
push 0x65eac0
push dword [0x68b268]
push 0x65e954
lea eax, [ebp - 0x13ac]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x13ac]
call fcn.0064dbd4
push dword [ebp - 8]
push 0x65eae8
lea edx, [ebp - 0x13b4]
mov eax, dword [0x68b268]
call fcn.00429364
push dword [ebp - 0x13b4]
push 0x65e954
lea eax, [ebp - 0x13b0]
mov edx, 4
call fcn.0040c414
mov eax, dword [ebp - 0x13b0]
call fcn.0064dbd4
mov eax, 0x65eb18
call fcn.00644f14
test al, al
je 0x65c98d
push 0x65eb40
lea edx, [ebp - 0x13bc]
mov eax, dword [0x68b268]
call fcn.00429488
push dword [ebp - 0x13bc]
push 0x65eba4
lea eax, [ebp - 0x13b8]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x13b8]
call fcn.0064dbd4
mov eax, 0x65ec08
call fcn.00644f14
test al, al
je 0x65c9d6
push 0x65eb40
lea edx, [ebp - 0x13c4]
mov eax, dword [0x68b268]
call fcn.00429488
push dword [ebp - 0x13c4]
push 0x65ec2c
lea eax, [ebp - 0x13c0]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x13c0]
call fcn.0064dbd4
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x420]
mov edx, 0x64
call fcn.0058e3a4
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
cmp byte [0x68b208], 0
je 0x65ca1d
push 0
mov ecx, 0x65ec8c
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65ca1d
call fcn.00657d1c
xor eax, eax
push ebp
push 0x65ca47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b28c]
call fcn.004097a0
mov eax, dword [ebp - 4]
call fcn.004097a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65ca51
xor eax, eax
push ebp
push 0x65ca7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x68b200]
mov edx, dword [eax]
call dword [edx + 0x6c]
mov eax, dword [0x68b200]
call fcn.004097a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65ca87
cmp byte [0x68b208], 0
je 0x65cb1b
push 0
push dword [0x68b264]
push 0x65ce04
lea ecx, [ebp - 0x13d0]
mov edx, 0x65ce14
mov eax, dword [0x68b248]
call fcn.00429244
push dword [ebp - 0x13d0]
lea eax, [ebp - 0x13cc]
mov edx, 3
call fcn.0040c414
mov eax, dword [ebp - 0x13cc]
lea edx, [ebp - 0x13c8]
call fcn.006452ac
mov eax, dword [ebp - 0x13c8]
call fcn.0040c128
push eax
lea eax, [ebp - 0x13d4]
mov ecx, 0x65ce2c
mov edx, dword [0x68b230]
call fcn.0040c38c
mov eax, dword [ebp - 0x13d4]
call fcn.0040c128
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x65cb1b
mov byte [0x68b20e], 1
cmp byte [0x68b208], 0
jne 0x65cbda
push 0
mov ecx, 0x65d1b8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65cbda
lea eax, [ebp - 0x13dc]
mov ecx, 0x65ecb4
mov edx, dword [0x68b264]
call fcn.0040c38c
mov eax, dword [ebp - 0x13dc]
lea edx, [ebp - 0x13d8]
call fcn.006452ac
mov eax, dword [ebp - 0x13d8]
mov dl, 1
call fcn.00428b40
test al, al
jne 0x65cbda
push 0
lea eax, [ebp - 0x13e4]
mov ecx, 0x65ecb4
mov edx, dword [0x68b264]
call fcn.0040c38c
mov eax, dword [ebp - 0x13e4]
lea edx, [ebp - 0x13e0]
call fcn.006452ac
mov eax, dword [ebp - 0x13e0]
call fcn.0040c128
push eax
lea eax, [ebp - 0x13e8]
mov ecx, 0x65ce2c
mov edx, dword [0x68b230]
call fcn.0040c38c
mov eax, dword [ebp - 0x13e8]
call fcn.0040c128
push eax
call sub.kernel32.dll_CopyFileW
push 0
mov ecx, 0x65d1b8
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65cc88
push 0
mov ecx, 0x65dac4
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65cc88
push 0xffffffffffffffff
mov ecx, 0x65daf0
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x65cc88
push 5
push 0
push 1
push 1
lea edx, [ebp - 0x13f0]
mov eax, dword [ebp - 0x60]
call fcn.00427e9c
mov ecx, dword [ebp - 0x13f0]
lea eax, [ebp - 0x13ec]
mov edx, 0x65ecdc
call fcn.0040c38c
mov eax, dword [ebp - 0x13ec]
push eax
lea eax, [ebp - 0x13f4]
mov ecx, 0x65ed08
mov edx, dword [0x68b264]
call fcn.0040c38c
mov edx, dword [ebp - 0x13f4]
xor eax, eax
pop ecx
call fcn.00645eb4
mov eax, dword [0x683324]
mov eax, dword [eax]
call fcn.0060c584
mov byte [0x68b210], 0
mov byte [0x68b283], 1
cmp byte [0x68b206], 0
jne 0x65cccc
push 0
mov ecx, 0x65ed30
mov edx, 0x65cf90
mov eax, dword [0x68b1f8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
test al, al
je 0x65cccc
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65cd3c
lea eax, [ebp - 0x13f4]
mov edx, 0x64
call fcn.0040b5f0
lea eax, [ebp - 0x1264]
mov edx, 0x24
call fcn.0040b5f0
lea eax, [ebp - 0x11cc]
mov edx, 0x3a
call fcn.0040b5f0
lea eax, [ebp - 0x52]
mov edx, dword [0x61aa64]
call fcn.0040cca4
lea eax, [ebp - 0x1c]
mov edx, dword [0x65933c]
call fcn.0040cca4
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040b5f0
pop eax
jmp eax