Function at 0x64d3e8
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x267
push 0
push 0
dec ecx
jne 0x64d3f0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
mov edx, dword [0x64d25c]
call fcn.0040a96c
lea eax, [ebp - 0x4a]
mov edx, dword [0x620f94]
call fcn.0040a96c
xor eax, eax
push ebp
push 0x65011e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48fe84]
call fcn.004b3834
mov dword [0x67c92c], eax
mov byte [0x67c8e9], 0
mov byte [0x67c8e8], 0
lea edx, [ebp - 0x1090]
mov eax, dword [ebp - 0x50]
mov ebx, dword [eax + 0x420]
mov eax, ebx
call fcn.005418f8
mov eax, dword [ebp - 0x1090]
lea edx, [ebp - 0x108c]
call fcn.00422c10
mov eax, dword [ebp - 0x108c]
lea edx, [ebp - 0x1088]
call fcn.0042b5b4
mov edx, dword [ebp - 0x1088]
mov eax, ebx
call fcn.0054194c
push 0
lea eax, [ebp - 0x1098]
push eax
mov ecx, 0x65013c
mov edx, 0x650168
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1098]
lea edx, [ebp - 0x1094]
call fcn.006428d8
mov edx, dword [ebp - 0x1094]
mov eax, 0x67c8fc
call fcn.0040994c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
xor edx, edx
call fcn.00577324
push 0x650180
lea eax, [ebp - 0x109c]
push eax
mov ecx, 0x6501a8
mov edx, 0x6501bc
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x109c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
push 0
mov ecx, 0x6501d8
mov edx, 0x650200
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov byte [0x67c8ec], al
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
xor eax, eax
mov dword [0x67c940], eax
xor eax, eax
mov dword [0x67c944], eax
xor eax, eax
mov dword [0x67c948], eax
xor eax, eax
mov dword [0x67c94c], eax
xor eax, eax
mov dword [0x67c950], eax
cmp byte [0x67c8ed], 0
je 0x64d714
lea edx, [ebp - 0x10a4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x10a4]
push 0x650218
push dword [0x67c924]
lea eax, [ebp - 0x10a0]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10a0]
mov dl, 1
call fcn.004241d0
test al, al
je 0x64d714
push 0
lea eax, [ebp - 0x10a8]
mov ecx, 0x650228
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x10a8]
call fcn.0040a13c
push eax
lea edx, [ebp - 0x10b0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x10b0]
push 0x650254
push dword [0x67c924]
lea eax, [ebp - 0x10ac]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x10ac]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x64d747
lea eax, [ebp - 0x10b4]
mov ecx, 0x650264
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x10b4]
mov dl, 1
mov eax, dword [0x507758]
call fcn.0050a904
mov dword [0x67c8dc], eax
mov ecx, dword [0x67c92c]
mov edx, 0x650290
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67c92c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67c940], eax
mov ecx, dword [0x67c92c]
mov edx, 0x6502a8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67c92c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67c944], eax
mov ecx, dword [0x67c92c]
mov edx, 0x6502c4
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67c92c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67c948], eax
mov ecx, dword [0x67c92c]
mov edx, 0x6502ec
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67c92c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67c94c], eax
mov ecx, dword [0x67c92c]
mov edx, 0x650318
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [0x67c92c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [0x67c950], eax
jmp 0x64d747
call fcn.00430920
push eax
lea eax, [ebp - 0x10b8]
mov ecx, 0x650338
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x10b8]
mov dl, 1
mov eax, dword [0x507758]
call fcn.0050a93c
mov dword [0x67c8dc], eax
push 0
mov ecx, 0x650364
mov edx, 0x650388
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
jne 0x64d77e
push 0
mov ecx, 0x6503a0
mov edx, 0x6503c8
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp al, 1
je 0x64ddd9
lea edx, [ebp - 0x10bc]
mov al, 0x1c
call fcn.006407c4
mov eax, dword [ebp - 0x10bc]
push eax
mov ecx, 0x6503e0
mov edx, 0x6503fc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x10c0]
mov al, 0x1d
call fcn.006407c4
mov eax, dword [ebp - 0x10c0]
push eax
mov ecx, 0x650418
mov edx, 0x65043c
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10c8]
push eax
mov ecx, 0x650458
mov edx, 0x650468
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10c8]
lea edx, [ebp - 0x10c4]
call fcn.006428d8
mov eax, dword [ebp - 0x10c4]
push eax
mov ecx, 0x650488
mov edx, 0x650498
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea eax, [ebp - 8]
call fcn.0040956c
push 0
mov ecx, 0x6504b8
mov edx, 0x6504d4
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64d8a3
push 0
mov ecx, 0x6504ec
mov edx, 0x650504
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64d8a3
lea eax, [ebp - 8]
mov edx, 0x65051c
call fcn.00409994
push 0
mov ecx, 0x6505d8
mov edx, 0x6505f0
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64d8a3
cmp dword [0x67c8bc], 0
jne 0x64d891
cmp dword [0x67c8b8], 0xe4e1c0
jbe 0x64d8a3
jmp 0x64d893
jle 0x64d8a3
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4b0]
mov dl, 1
call fcn.00541814
push 0
lea eax, [ebp - 0x10d4]
push eax
mov ecx, 0x650608
mov edx, 0x650618
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10d4]
lea edx, [ebp - 0x10d0]
call fcn.006428d8
mov ecx, dword [ebp - 0x10d0]
lea eax, [ebp - 0x10cc]
mov edx, dword [ebp - 8]
call fcn.0040a390
mov eax, dword [ebp - 0x10cc]
push eax
mov ecx, 0x650638
mov edx, 0x650648
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10dc]
push eax
mov ecx, 0x650668
mov edx, 0x650678
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10dc]
lea edx, [ebp - 0x10d8]
call fcn.006428d8
mov eax, dword [ebp - 0x10d8]
push eax
mov ecx, 0x650698
mov edx, 0x6506a8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10e4]
push eax
mov ecx, 0x6506c8
mov edx, 0x6506d8
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10e4]
lea edx, [ebp - 0x10e0]
call fcn.006428d8
mov eax, dword [ebp - 0x10e0]
push eax
mov ecx, 0x6506f8
mov edx, 0x650708
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10ec]
push eax
mov ecx, 0x650728
mov edx, 0x650738
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10ec]
lea edx, [ebp - 0x10e8]
call fcn.006428d8
mov eax, dword [ebp - 0x10e8]
push eax
mov ecx, 0x650758
mov edx, 0x650768
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10f4]
push eax
mov ecx, 0x650788
mov edx, 0x650798
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10f4]
lea edx, [ebp - 0x10f0]
call fcn.006428d8
mov eax, dword [ebp - 0x10f0]
push eax
mov ecx, 0x6507b8
mov edx, 0x6507c8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x10fc]
push eax
mov ecx, 0x6507e8
mov edx, 0x6507f8
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x10fc]
lea edx, [ebp - 0x10f8]
call fcn.006428d8
mov eax, dword [ebp - 0x10f8]
push eax
mov ecx, 0x650818
mov edx, 0x650828
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1104]
push eax
mov ecx, 0x650848
mov edx, 0x650858
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1104]
lea edx, [ebp - 0x1100]
call fcn.006428d8
mov eax, dword [ebp - 0x1100]
push eax
mov ecx, 0x650878
mov edx, 0x650888
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x6508a8
mov edx, 0x6508b8
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x110c]
lea edx, [ebp - 0x1108]
call fcn.006428d8
mov eax, dword [ebp - 0x1108]
push eax
mov ecx, 0x6508d8
mov edx, 0x6508e8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1114]
push eax
mov ecx, 0x650908
mov edx, 0x650918
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1114]
lea edx, [ebp - 0x1110]
call fcn.006428d8
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, 0x650938
mov edx, 0x650948
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x111c]
push eax
mov ecx, 0x650968
mov edx, 0x650978
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x111c]
lea edx, [ebp - 0x1118]
call fcn.006428d8
mov eax, dword [ebp - 0x1118]
push eax
mov ecx, 0x650994
mov edx, 0x6509a4
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1124]
push eax
mov ecx, 0x6509c0
mov edx, 0x6509d0
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1124]
lea edx, [ebp - 0x1120]
call fcn.006428d8
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, 0x6509ec
mov edx, 0x6509fc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x112c]
push eax
mov ecx, 0x650a18
mov edx, 0x650a28
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x112c]
lea edx, [ebp - 0x1128]
call fcn.006428d8
mov eax, dword [ebp - 0x1128]
push eax
mov ecx, 0x650a44
mov edx, 0x650a54
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1134]
push eax
mov ecx, 0x650a70
mov edx, 0x650a80
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1134]
lea edx, [ebp - 0x1130]
call fcn.006428d8
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, 0x650a9c
mov edx, 0x650aac
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x113c]
push eax
mov ecx, 0x650ac8
mov edx, 0x650ad8
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x113c]
lea edx, [ebp - 0x1138]
call fcn.006428d8
mov eax, dword [ebp - 0x1138]
push eax
mov ecx, 0x650af4
mov edx, 0x650b04
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1144]
push eax
mov ecx, 0x650b20
mov edx, 0x650b30
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1144]
lea edx, [ebp - 0x1140]
call fcn.006428d8
mov eax, dword [ebp - 0x1140]
push eax
mov ecx, 0x650b4c
mov edx, 0x650b5c
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x114c]
push eax
mov ecx, 0x650b78
mov edx, 0x650b88
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x114c]
lea edx, [ebp - 0x1148]
call fcn.006428d8
mov eax, dword [ebp - 0x1148]
push eax
mov ecx, 0x650ba4
mov edx, 0x650bb4
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1154]
push eax
mov ecx, 0x650bd0
mov edx, 0x650be0
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1154]
lea edx, [ebp - 0x1150]
call fcn.006428d8
mov eax, dword [ebp - 0x1150]
push eax
mov ecx, 0x650bfc
mov edx, 0x650c0c
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x115c]
push eax
mov ecx, 0x650c28
mov edx, 0x650c38
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x115c]
lea edx, [ebp - 0x1158]
call fcn.006428d8
mov eax, dword [ebp - 0x1158]
push eax
mov ecx, 0x650c54
mov edx, 0x650c64
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x1160]
mov al, 0x37
call fcn.006407c4
mov eax, dword [ebp - 0x1160]
push eax
mov ecx, 0x650c80
mov edx, 0x650c98
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
movzx eax, byte [0x67c8e7]
xor al, 1
push eax
mov ecx, 0x650cb4
mov edx, 0x650ccc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
movzx eax, byte [0x67c8e0]
push eax
mov ecx, 0x650ce8
mov edx, 0x650cfc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
lea edx, [ebp - 0x1164]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
mov eax, dword [ebp - 0x1164]
push eax
mov ecx, 0x650d18
mov edx, 0x650d3c
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [0x67c8fc], 0
je 0x64de8d
mov eax, dword [0x67c8fc]
push eax
mov ecx, 0x650d58
mov edx, 0x650d84
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x1168]
mov al, 0x1a
call fcn.006407c4
mov eax, dword [ebp - 0x1168]
push eax
mov ecx, 0x650da0
mov edx, 0x650dcc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [0x67c8e1], 0
je 0x64e114
push 0
mov ecx, 0x650de8
mov edx, 0x650e14
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x650e2c
mov edx, 0x650e50
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x650e6c
mov edx, 0x650e98
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x650eb0
mov edx, 0x650edc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x650ef8
mov edx, 0x650f28
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x650f40
mov edx, 0x650f70
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x650f8c
mov edx, 0x650fbc
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64dfa8
push 0
lea eax, [ebp - 0x1170]
push eax
mov ecx, 0x650fd4
mov edx, 0x651014
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1170]
lea edx, [ebp - 0x116c]
call fcn.006428d8
mov eax, dword [ebp - 0x116c]
push eax
mov ecx, 0x65102c
mov edx, 0x65106c
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x64dfbe
push 0
mov ecx, 0x651088
mov edx, 0x6510c8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x6510e4
mov edx, 0x651118
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64e023
push 0
lea eax, [ebp - 0x1178]
push eax
mov ecx, 0x651130
mov edx, 0x651158
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1178]
lea edx, [ebp - 0x1174]
call fcn.006428d8
mov eax, dword [ebp - 0x1174]
push eax
mov ecx, 0x651170
mov edx, 0x651198
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x64e039
push 0
mov ecx, 0x6511b4
mov edx, 0x6511dc
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x6511f8
mov edx, 0x651220
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x651238
mov edx, 0x651260
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x65127c
mov edx, 0x6512ac
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64e114
push 0
lea eax, [ebp - 0x1180]
push eax
mov ecx, 0x6512c4
mov edx, 0x6512fc
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1180]
lea edx, [ebp - 0x117c]
call fcn.006428d8
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, 0x651314
mov edx, 0x651334
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
lea eax, [ebp - 0x1188]
push eax
mov ecx, 0x651350
mov edx, 0x651388
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1188]
lea edx, [ebp - 0x1184]
call fcn.006428d8
mov eax, dword [ebp - 0x1184]
push eax
mov ecx, 0x6513a0
mov edx, 0x6513c8
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x6513e4
mov edx, 0x651400
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64e27d
push 0
mov ecx, 0x651418
mov edx, 0x651440
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x651458
mov edx, 0x651480
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
lea eax, [ebp - 0x1190]
push eax
mov ecx, 0x65149c
mov edx, 0x6514bc
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x1190]
lea edx, [ebp - 0x118c]
call fcn.006428d8
mov eax, dword [ebp - 0x118c]
push eax
mov ecx, 0x6514d4
mov edx, 0x6514f4
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0
mov ecx, 0x651510
mov edx, 0x651540
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x651558
mov edx, 0x651588
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6515a4
mov edx, 0x6515d8
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6515f0
mov edx, 0x651624
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x651640
mov edx, 0x65166c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x651684
mov edx, 0x6516b0
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x6516cc
mov edx, 0x6516fc
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x651714
mov edx, 0x651744
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
push 0
mov ecx, 0x651760
mov edx, 0x651794
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
push eax
mov ecx, 0x6517ac
mov edx, 0x6517e0
mov eax, dword [0x67c8dc]
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
cmp byte [0x67c8e0], 0
je 0x64e2fa
xor eax, eax
push ebp
push 0x64e2f0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x67c95c], eax
push 0x6517f0
push 0x651830
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x67c954], eax
push 0x65184c
push 0x651830
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411f08
mov dword [0x67c958], eax
push 0x67c95c
call dword [0x67c954]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64e2fa
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0x651894
lea eax, [ebp - 0x1194]
push eax
mov ecx, 0x6518c8
mov edx, 0x6518dc
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1194]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
xor eax, eax
push ebp
push 0x64e3d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0x1198]
xor eax, eax
call fcn.00406c04
mov ecx, dword [ebp - 0x1198]
mov dl, 1
mov eax, dword [0x492d14]
call fcn.004b5ec8
mov dword [0x67c8a8], eax
mov eax, dword [0x67c8c8]
xor edx, edx
push edx
push eax
mov eax, dword [0x67c8a8]
call fcn.004b3900
push 0xff00
lea eax, [ebp - 0x119c]
mov ecx, 0x6518f8
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov ecx, dword [ebp - 0x119c]
mov dl, 1
mov eax, dword [0x492d14]
call fcn.004b5ec8
mov dword [0x67c8ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64e428
xor esi, esi
mov eax, dword [0x67c8cc]
sub eax, esi
cmp eax, 0x1000
jb 0x64e451
lea edx, [ebp - 0x1084]
mov ecx, 0x1000
mov eax, dword [0x67c8a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
jmp 0x64e465
mov ecx, eax
lea edx, [ebp - 0x1084]
mov eax, dword [0x67c8a8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
lea edx, [ebp - 0x1084]
mov ecx, ebx
mov eax, dword [0x67c8ac]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, ebx
mov eax, dword [0x67c8cc]
mov dword [ebp - 0x11a4], eax
xor eax, eax
mov dword [ebp - 0x11a0], eax
fild qword [ebp - 0x11a4]
fdivr dword [0x651918]
mov dword [ebp - 0x11a4], esi
xor eax, eax
mov dword [ebp - 0x11a0], eax
fild qword [ebp - 0x11a4]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
call fcn.00577324
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
cmp ebx, 0x1000
je 0x64e42a
mov eax, dword [0x67c8ac]
call fcn.004078f0
mov eax, dword [0x67c8a8]
call fcn.004078f0
push 0x651928
lea eax, [ebp - 0x11a8]
push eax
mov ecx, 0x651958
mov edx, 0x651968
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov dl, 1
mov eax, dword [0x6212e4]
call fcn.00627434
mov dword [0x67c8b0], eax
xor eax, eax
push ebp
push 0x64e580
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11ac]
mov ecx, 0x651984
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov edx, dword [ebp - 0x11ac]
mov cl, 1
mov eax, dword [0x67c8b0]
call fcn.006274b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64e5d5
mov dl, 1
mov eax, dword [0x48fe84]
call fcn.004b3834
mov dword [ebp - 4], eax
mov byte [ebp - 0x66], 0
push 0
mov ecx, 0x6519b0
mov edx, 0x6519d4
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x64], eax
cmp dword [0x67c8bc], 0
jne 0x64e618
cmp dword [0x67c8b8], 0x989680
jbe 0x64e63e
jmp 0x64e61a
jle 0x64e63e
push 0
mov ecx, 0x6519ec
mov edx, 0x651a18
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64e63e
mov eax, 0x651a30
call fcn.0058ad2c
mov eax, dword [ebp - 0x64]
dec eax
test eax, eax
jl 0x64f038
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
cmp byte [0x67c8e9], 0
je 0x64e665
push ebp
call fcn.0064d2bc
pop ecx
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x11b0]
mov eax, dword [ebp - 0x58]
call fcn.00423594
mov ecx, dword [ebp - 0x11b0]
mov edx, 0x651a84
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 8], 0
je 0x64f02c
push 0x651a9c
push dword [0x67c920]
push 0x651ac4
lea eax, [ebp - 0x11b4]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x11b4]
mov eax, dword [ebp - 8]
call fcn.0040a4c8
je 0x64f02c
movzx eax, byte [0x651ad0]
push eax
lea eax, [ebp - 0x11b8]
push eax
mov ecx, 0x651ae0
mov edx, 0x651af4
mov eax, dword [ebp - 8]
call fcn.0042b7e4
mov edx, dword [ebp - 0x11b8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 3
jne 0x64f02c
lea ecx, [ebp - 0x11c0]
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c0]
lea edx, [ebp - 0x11bc]
call fcn.006428d8
mov edx, dword [ebp - 0x11bc]
lea eax, [ebp - 0x14]
call fcn.00409994
lea ecx, [ebp - 0x11c4]
mov edx, 1
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c4]
mov edx, 1
call fcn.00423840
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x11cc]
mov edx, 2
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x11cc]
lea edx, [ebp - 0x11c8]
call fcn.00422c10
mov eax, dword [ebp - 0x11c8]
mov edx, 0x651b04
call fcn.0040a4c8
sete al
xor al, 1
mov byte [ebp - 0xf], al
xor eax, eax
mov dword [ebp - 0x54], eax
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x651b14
call fcn.0040a710
test eax, eax
jne 0x64e83c
cmp byte [0x67c8ec], 0
jne 0x64e7e7
lea edx, [ebp - 0x11d0]
mov eax, dword [ebp - 0x14]
call fcn.00643b24
mov edx, dword [ebp - 0x11d0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
call fcn.0054194c
xor eax, eax
push ebp
push 0x64e832
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x11d4]
mov eax, dword [ebp - 0x58]
call fcn.00423594
mov edx, dword [ebp - 0x11d4]
mov eax, dword [0x67c8b0]
call fcn.00628e70
mov edx, eax
lea ecx, [ebp - 0x4a]
mov eax, dword [0x67c8b0]
call fcn.006263d0
mov eax, dword [ebp - 0x42]
mov dword [ebp - 0x54], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64e83c
fild dword [ebp - 0x64]
fdivr dword [0x651918]
fild dword [ebp - 0x58]
fmulp st(1)
call fcn.0040710c
mov edx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
call fcn.00577324
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x651b3c
call fcn.0040a710
test eax, eax
jne 0x64eadc
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241d0
test al, al
je 0x64eadc
cmp byte [0x67c8e2], 0
je 0x64e8aa
cmp byte [ebp - 0x10], 0
jne 0x64e8aa
mov byte [ebp - 0x10], 1
cmp byte [ebp - 0x66], 0
jne case.0x64e915.0
cmp byte [ebp - 0x10], 0
jne case.0x64e915.0
push 0
push 0
lea eax, [ebp - 0x11dc]
push eax
mov ecx, 0x651b64
mov edx, 0x651b78
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x11dc]
lea ecx, [ebp - 0x11d8]
mov edx, dword [ebp - 0x14]
call fcn.006432a4
mov eax, dword [ebp - 0x11d8]
movzx ecx, word [0x651b8c]
xor edx, edx
call fcn.0058ab94
cmp eax, 0xe
ja case.0x64e915.0
movzx eax, byte [eax + 0x64e91c]
jmp dword [eax*4 + 0x64e92b]
mov byte [ebp - 0x10], 1
jmp case.0x64e915.0
mov byte [ebp - 0x10], 3
jmp case.0x64e915.0
mov byte [ebp - 0x66], 1
mov byte [ebp - 0x10], 1
jmp case.0x64e915.0
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x10], 3
jmp case.0x64e915.0
mov eax, dword [ebp - 0x50]
call fcn.00610c80
cmp byte [0x67c8e9], 0
je 0x64f02c
mov eax, dword [0x67c8b0]
call fcn.004078f0
push ebp
call fcn.0064d2bc
pop ecx
jmp 0x64f02c
cmp byte [ebp - 0x10], 1
je 0x64e99a
cmp byte [ebp - 0x66], 1
jne 0x64e9c4
xor eax, eax
push ebp
push 0x64e9ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00424864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64e9c4
movzx eax, byte [ebp - 0x10]
cmp al, 3
je 0x64e9d2
cmp byte [ebp - 0x66], 3
jne 0x64e9df
mov eax, dword [ebp - 0x14]
call fcn.0064d038
jmp 0x64f02c
cmp al, 2
jne 0x64eadc
push 0
lea edx, [ebp - 0x11e0]
mov eax, dword [ebp - 0x58]
call fcn.00423594
mov edx, dword [ebp - 0x11e0]
mov ecx, dword [0x67c8f4]
mov eax, dword [0x67c8b0]
call fcn.00627a10
push dword [0x67c8f4]
push 0x651b9c
lea edx, [ebp - 0x11e8]
mov eax, dword [ebp - 0x58]
call fcn.00423594
push dword [ebp - 0x11e8]
lea eax, [ebp - 0x11e4]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x11e4]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x14]
call fcn.0064ce84
test al, al
je 0x64ea95
mov eax, dword [ebp - 0x14]
call fcn.00424864
push dword [0x67c8f4]
push 0x651bac
lea edx, [ebp - 0x11f0]
mov eax, dword [ebp - 0x58]
call fcn.00423594
push dword [ebp - 0x11f0]
lea eax, [ebp - 0x11ec]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x11ec]
call fcn.00424864
jmp 0x64eadc
push dword [0x67c8f4]
push 0x651bbc
lea edx, [ebp - 0x11f8]
mov eax, dword [ebp - 0x58]
call fcn.00423594
push dword [ebp - 0x11f8]
lea eax, [ebp - 0x11f4]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x11f4]
call fcn.00424864
mov eax, dword [ebp - 0x14]
call fcn.0064d038
jmp 0x64f02c
lea eax, [ebp - 0x11fc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x11fc]
mov edx, 0x651bcc
call fcn.0040a4c8
jne 0x64eb40
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x64eb13
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x651be0
call fcn.0040a710
add eax, 3
jmp 0x64eb45
mov eax, 3
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x64eb5f
mov eax, dword [ebp - 0x80]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
sub edx, eax
jl 0x64ed3b
inc edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x5c]
cmp word [eax + edx*2 - 2], 0x5c
jne 0x64ed2f
lea eax, [ebp - 0x1200]
push eax
mov ebx, dword [ebp - 0x5c]
dec ebx
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1200]
mov dl, 1
call fcn.00424268
test al, al
jne 0x64ed2f
xor eax, eax
push ebp
push 0x64ebf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1204]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov eax, dword [ebp - 0x1204]
call fcn.004069bc
call fcn.00406960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64ecf8
cmp byte [0x67c8e1], 0
je 0x64ed2f
cmp byte [ebp - 0xf], 0
je 0x64ed2f
lea eax, [ebp - 0x1220]
push eax
mov ecx, dword [ebp - 0x5c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040a500
mov edx, dword [ebp - 0x1220]
mov eax, 0x651cbc
call fcn.00643f34
inc dword [ebp - 0x5c]
dec dword [ebp - 0x78]
jne 0x64eb74
mov ecx, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x651cd8
call fcn.0040a710
test eax, eax
jg 0x64f02c
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241d0
test al, al
je 0x64ee7a
lea edx, [ebp - 0x1224]
mov eax, dword [ebp - 0x14]
call fcn.00424b30
mov eax, dword [ebp - 0x1224]
mov edx, 0x651d00
call fcn.0040a4c8
jne 0x64edb7
push 1
push 0
push 0x651d18
push 0x651d5c
push 0x651d6c
push 0
call sub.shell32.dll_ShellExecuteW
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.0042459c
test eax, 1
jle 0x64edfa
xor eax, eax
push ebp
push 0x64edf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x80
mov eax, dword [ebp - 0x14]
call fcn.00424654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64edfa
lea edx, [ebp - 0x122c]
mov eax, dword [ebp - 0x14]
call fcn.00424b6c
mov eax, dword [ebp - 0x122c]
lea edx, [ebp - 0x1228]
call fcn.00422804
mov eax, dword [ebp - 0x1228]
mov edx, 0x651d84
call fcn.0040a4c8
je 0x64ee5c
lea edx, [ebp - 0x1234]
mov eax, dword [ebp - 0x14]
call fcn.00424b6c
mov eax, dword [ebp - 0x1234]
lea edx, [ebp - 0x1230]
call fcn.00422804
mov eax, dword [ebp - 0x1230]
mov edx, 0x651d9c
call fcn.0040a4c8
jne 0x64ee7a
mov eax, dword [ebp - 0x14]
call fcn.0064cf38
push 0x12c
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov byte [ebp - 0x65], 0
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004241d0
test al, al
je 0x64eeb6
xor eax, eax
push ebp
push 0x64eeac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00424864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64eeb6
xor eax, eax
push ebp
push 0x64eef4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x1238]
mov eax, dword [ebp - 0x58]
call fcn.00423594
mov edx, dword [ebp - 0x1238]
mov ecx, dword [ebp - 0x14]
mov eax, dword [0x67c8b0]
call fcn.00627a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64efaf
cmp byte [ebp - 0x65], 0
jne 0x64ee7a
xor eax, eax
push ebp
push 0x64efdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x42]
mov eax, dword [ebp - 0x14]
call fcn.00424504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64f004
cmp byte [0x67c8e1], 0
je 0x64f020
cmp byte [ebp - 0xf], 0
je 0x64f020
mov edx, dword [ebp - 0x14]
mov eax, 0x651e7c
call fcn.00643f34
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64e655
xor eax, eax
push ebp
push 0x64f064
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67c8b0]
call fcn.00627624
mov eax, dword [0x67c8b0]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64f06e
push 0x651e94
lea eax, [ebp - 0x124c]
push eax
mov ecx, 0x651ec8
mov edx, 0x651edc
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x124c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov ecx, dword [ebp - 4]
mov edx, 0x651ef8
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64f181
push 0x651f18
lea eax, [ebp - 0x1250]
push eax
mov ecx, 0x651f50
mov edx, 0x651f60
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1250]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64f171
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x1254]
push eax
lea ecx, [ebp - 0x1258]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1258]
mov edx, 0x651f7c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1254]
mov eax, dword [ebp - 0x50]
call fcn.00645074
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64f12c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
cmp byte [0x67c8e1], 0
je 0x64f248
cmp byte [0x67c8ed], 0
jne 0x64f248
lea edx, [ebp - 0x1260]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x1260]
push 0x651f9c
push dword [0x67c920]
lea eax, [ebp - 0x125c]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x125c]
mov eax, 0x651fac
call fcn.00643f34
lea edx, [ebp - 0x1268]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x1268]
push 0x651fc4
movzx eax, byte [0x651fc8]
push eax
lea eax, [ebp - 0x126c]
push eax
mov ecx, 0x651fd8
mov edx, 0x651ff0
mov eax, dword [0x67c920]
call fcn.0042b7e4
push dword [ebp - 0x126c]
lea eax, [ebp - 0x1264]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x1264]
mov eax, 0x652008
call fcn.00643f34
push 0
mov ecx, 0x652020
mov edx, 0x652038
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64fbf7
push 0
mov ecx, 0x652050
mov edx, 0x652074
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jle 0x64f371
push 0x65208c
lea eax, [ebp - 0x1270]
push eax
mov ecx, 0x6520c0
mov edx, 0x6520d4
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1270]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
cmp byte [0x67c8e2], 0
je 0x64f2e5
mov word [ebp - 0x6e], 0
jmp 0x64f2eb
mov word [ebp - 0x6e], 1
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x6520f0
mov edx, 0x652120
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [ebp - 0xc], 0
jne 0x64f318
lea eax, [ebp - 0xc]
mov edx, 0x652138
call fcn.00409994
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x64f324
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x64f371
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x73
jne 0x64f371
mov word [ebp - 0x6e], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x64f359
mov eax, dword [ebp - 0x84]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x84]
dec ecx
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.0040a500
push 0
mov ecx, 0x652170
mov edx, 0x652194
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
dec eax
je 0x64f396
dec eax
je 0x64f49e
jmp 0x64f654
push 0
lea eax, [ebp - 0x1278]
push eax
mov ecx, 0x6521ac
mov edx, 0x6521d4
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, dword [ebp - 0x1278]
lea eax, [ebp - 0x1274]
mov edx, 0x6521ec
call fcn.0040a390
mov eax, dword [ebp - 0x1274]
lea edx, [ebp - 8]
call fcn.006428d8
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241d0
test al, al
jne 0x64f3f3
lea eax, [ebp - 8]
mov edx, dword [0x67c914]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.004241d0
test al, al
je 0x64f492
lea edx, [ebp - 0x127c]
mov eax, 0x652214
call fcn.006428d8
mov eax, dword [ebp - 0x127c]
mov dl, 1
call fcn.004241d0
test al, al
je 0x64f492
movzx eax, word [ebp - 0x6e]
push eax
push 1
push 0
push 0x652250
push dword [ebp - 8]
push 0x652264
push dword [ebp - 0xc]
lea eax, [ebp - 0x1284]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x1284]
lea edx, [ebp - 0x1280]
call fcn.006428d8
mov eax, dword [ebp - 0x1280]
push eax
lea edx, [ebp - 0x1288]
mov eax, 0x652278
call fcn.006428d8
mov eax, dword [ebp - 0x1288]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab1c
pop edx
pop ecx
call fcn.006490ac
jmp 0x64f654
mov byte [0x67c8e8], 1
jmp 0x64f654
push 0
lea eax, [ebp - 0x128c]
push eax
mov ecx, 0x6522b4
mov edx, 0x6522dc
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x128c]
lea edx, [ebp - 8]
call fcn.006428d8
cmp dword [ebp - 8], 0
je 0x64f64d
lea edx, [ebp - 0x1290]
mov eax, dword [ebp - 8]
call fcn.0064d1c4
cmp dword [ebp - 0x1290], 0
je 0x64f64d
lea edx, [ebp - 0x1294]
mov eax, 0x6522f4
call fcn.006428d8
mov eax, dword [ebp - 0x1294]
mov dl, 1
call fcn.004241d0
test al, al
je 0x64f64d
push 1
push 1
push 0
push 0x65233c
push dword [ebp - 8]
push 0x652354
lea edx, [ebp - 0x12a0]
mov eax, dword [ebp - 8]
call fcn.0064d1c4
push dword [ebp - 0x12a0]
push 0x65238c
lea eax, [ebp - 0x129c]
mov edx, 5
call fcn.0040a418
mov eax, dword [ebp - 0x129c]
lea edx, [ebp - 0x1298]
call fcn.006428d8
mov eax, dword [ebp - 0x1298]
push eax
lea edx, [ebp - 0x12a4]
mov eax, 0x65239c
call fcn.006428d8
mov eax, dword [ebp - 0x12a4]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab1c
pop edx
pop ecx
call fcn.006490ac
test al, al
je 0x64f644
mov eax, dword [0x67c900]
mov edx, 0x6523e4
call fcn.0040a4c8
je 0x64f63b
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
movzx eax, word [ebp - 0x6e]
push eax
push 1
push 0
push 0x6523f4
lea edx, [ebp - 0x12b0]
mov eax, dword [ebp - 8]
call fcn.0064d1c4
push dword [ebp - 0x12b0]
push 0x652428
push dword [ebp - 0xc]
lea eax, [ebp - 0x12ac]
mov edx, 4
call fcn.0040a418
mov eax, dword [ebp - 0x12ac]
lea edx, [ebp - 0x12a8]
call fcn.006428d8
mov eax, dword [ebp - 0x12a8]
push eax
lea edx, [ebp - 0x12b4]
mov eax, 0x65243c
call fcn.006428d8
mov eax, dword [ebp - 0x12b4]
push eax
mov eax, dword [ebp - 0x50]
call fcn.0054ab1c
pop edx
pop ecx
call fcn.006490ac
test al, al
jne 0x64f654
mov byte [0x67c8e8], 1
jmp 0x64f654
mov byte [0x67c8e8], 1
jmp 0x64f654
mov byte [0x67c8e8], 1
jmp 0x64f654
mov byte [0x67c8e8], 1
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4a8]
cmp byte [eax + 0x69], 0
je 0x64f765
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4a8]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x64f765
push 0x652478
lea eax, [ebp - 0x12b8]
push eax
mov ecx, 0x6524b8
mov edx, 0x6524c8
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12b8]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov ecx, dword [ebp - 4]
mov edx, 0x6524e4
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64f739
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12bc]
push eax
lea ecx, [ebp - 0x12c0]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12c0]
mov edx, 0x652508
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12bc]
mov eax, dword [ebp - 0x50]
call fcn.00647978
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64f6f4
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov ecx, dword [ebp - 4]
mov edx, 0x65252c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64f847
push 0x65254c
lea eax, [ebp - 0x12c4]
push eax
mov ecx, 0x652594
mov edx, 0x6525a4
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12c4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64f837
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
cmp byte [0x67c8e9], 0
jne 0x64f837
push 0
lea eax, [ebp - 0x12c8]
push eax
lea ecx, [ebp - 0x12cc]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12cc]
mov edx, 0x6525c0
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12c8]
mov eax, dword [ebp - 0x50]
call fcn.00646448
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64f7e9
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov ecx, dword [ebp - 4]
mov edx, 0x6525e0
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64f8fa
push 0x6525f4
lea eax, [ebp - 0x12d0]
push eax
mov ecx, 0x652630
mov edx, 0x652640
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12d0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64f8fa
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12d4]
push eax
lea ecx, [ebp - 0x12d8]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12d8]
mov edx, 0x65265c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12d4]
mov eax, dword [ebp - 0x50]
call fcn.00647464
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64f8b5
push 0
mov ecx, 0x652670
mov edx, 0x65269c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64f939
cmp byte [0x67c8e7], 0
je 0x64f92c
mov edx, 0x6526b4
mov eax, dword [ebp - 0x50]
call fcn.00646448
jmp 0x64f939
mov edx, 0x6527c0
mov eax, dword [ebp - 0x50]
call fcn.00646448
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x4cc]
mov edx, dword [eax]
call dword [edx + 0x104]
test al, al
je 0x64f9b5
cmp byte [0x67c8e7], 0
je 0x64f987
push 0x6528cc
push dword [0x67c8fc]
push 0x652968
lea eax, [ebp - 0x12dc]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12dc]
mov eax, dword [ebp - 0x50]
call fcn.00646448
jmp 0x64f9b5
push 0x65299c
push dword [0x67c8fc]
push 0x652a38
lea eax, [ebp - 0x12e0]
mov edx, 3
call fcn.0040a418
mov edx, dword [ebp - 0x12e0]
mov eax, dword [ebp - 0x50]
call fcn.00646448
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov ecx, dword [ebp - 4]
mov edx, 0x652a6c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x64fac8
push 0x652a94
lea eax, [ebp - 0x12e4]
push eax
mov ecx, 0x652adc
mov edx, 0x652aec
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12e4]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64fa78
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12e8]
push eax
lea ecx, [ebp - 0x12ec]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12ec]
mov edx, 0x652b08
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12e8]
mov eax, dword [ebp - 0x50]
call fcn.00648624
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64fa33
xor eax, eax
push ebp
push 0x64faae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
push eax
push 0x1388
push 2
push 0x652b24
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64fab8
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
push 0x652b48
lea eax, [ebp - 0x12f0]
push eax
mov ecx, 0x652b7c
mov edx, 0x652b90
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12f0]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
mov ecx, dword [ebp - 4]
mov edx, 0x652bac
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64fb77
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12f4]
push eax
lea ecx, [ebp - 0x12f8]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x12f8]
mov edx, 0x652bc8
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12f4]
mov eax, dword [ebp - 0x50]
call fcn.0064a688
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64fb32
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x42c]
xor edx, edx
call fcn.0054194c
mov ecx, dword [ebp - 4]
mov edx, 0x652be4
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x44]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x64fbf7
inc eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x12fc]
push eax
lea ecx, [ebp - 0x1300]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1300]
mov edx, 0x652c04
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x12fc]
mov ax, 4
call fcn.0064abc0
inc dword [ebp - 0x58]
dec dword [ebp - 0x74]
jne 0x64fbb1
cmp byte [0x67c8e0], 0
je 0x64fc2e
xor eax, eax
push ebp
push 0x64fc24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67c95c]
push eax
call dword [0x67c958]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64fc2e
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x434]
mov edx, 0x64
call fcn.00577324
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0x1f4
call sub.kernel32.dll_Sleep_2
push 0x652c24
lea eax, [ebp - 0x1304]
push eax
mov ecx, 0x652c58
mov edx, 0x652c6c
mov eax, dword [0x67c8d8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp - 0x1304]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x430]
call fcn.0054194c
cmp byte [0x67c8e1], 0
je 0x64fcb3
push 0
mov ecx, 0x652c88
mov edx, 0x652cb0
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64fcb3
call fcn.0064c068
push 0
mov ecx, 0x652cc8
mov edx, 0x652cf8
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
jne 0x64fceb
push 0
mov ecx, 0x652d10
mov edx, 0x652d44
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64fd97
lea edx, [ebp - 0x1308]
mov eax, 0x652d5c
call fcn.006428d8
mov eax, dword [ebp - 0x1308]
mov dl, 1
call fcn.004241d0
test al, al
je 0x64fd97
xor eax, eax
push ebp
push 0x64fd8d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x130c]
mov eax, 0x652da4
call fcn.006428d8
mov eax, dword [ebp - 0x130c]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1310]
mov ecx, 0x652de8
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1310]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
lea edx, [ebp - 0x1314]
mov eax, 0x652e14
call fcn.006428d8
mov edx, dword [ebp - 0x1314]
mov eax, 0x652e58
call fcn.00643f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64fd97
xor eax, eax
push ebp
push 0x64fdc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67c92c]
call fcn.004078f0
mov eax, dword [ebp - 4]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64fdcb
xor eax, eax
push ebp
push 0x64fdf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67c8dc]
mov edx, dword [eax]
call dword [edx + 0x60]
mov eax, dword [0x67c8dc]
call fcn.004078f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64fe01
cmp byte [0x67c8e1], 0
je 0x64ffa3
cmp byte [0x67c8ed], 0
jne 0x64ff25
push 0
lea edx, [ebp - 0x131c]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x131c]
push 0x652e70
push dword [0x67c920]
lea eax, [ebp - 0x1318]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1318]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1320]
mov ecx, 0x652e80
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1320]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x64ff1e
push 0
lea edx, [ebp - 0x1328]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x1328]
push 0x652eac
movzx eax, byte [0x651fc8]
push eax
lea eax, [ebp - 0x132c]
push eax
mov ecx, 0x652ebc
mov edx, 0x652ed4
mov eax, dword [0x67c920]
call fcn.0042b7e4
push dword [ebp - 0x132c]
lea eax, [ebp - 0x1324]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1324]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x1330]
mov ecx, 0x652eec
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x1330]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x64ff25
mov byte [0x67c8e8], 1
cmp byte [0x67c8ed], 0
je 0x64ffa3
push 0
lea edx, [ebp - 0x1338]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0x420]
call fcn.005418f8
push dword [ebp - 0x1338]
push 0x652f18
push dword [0x67c924]
lea eax, [ebp - 0x1334]
mov edx, 3
call fcn.0040a418
mov eax, dword [ebp - 0x1334]
call fcn.0040a13c
push eax
lea eax, [ebp - 0x133c]
mov ecx, 0x652f28
mov edx, dword [0x67c8f4]
call fcn.0040a390
mov eax, dword [ebp - 0x133c]
call fcn.0040a13c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x64ffa3
mov byte [0x67c8e8], 1
mov eax, dword [0x67644c]
mov eax, dword [eax]
call fcn.00615e70
push 0
mov ecx, 0x652f54
mov edx, 0x652f6c
mov eax, dword [0x67c8d4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
test al, al
je 0x64ffd0
push 0
call sub.user32.dll_MessageBeep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650128
lea eax, [ebp - 0x133c]
call fcn.0040956c
lea eax, [ebp - 0x1338]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1330]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1328]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1320]
call fcn.0040956c
lea eax, [ebp - 0x131c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x1314]
mov edx, 0x2b
call fcn.004095cc
lea eax, [ebp - 0x1268]
mov edx, 4
call fcn.004095cc
lea eax, [ebp - 0x1258]
mov edx, 0x2b
call fcn.004095cc
lea eax, [ebp - 0x11ac]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x119c]
mov edx, 0xe
call fcn.004095cc
lea eax, [ebp - 0x1164]
call fcn.0040956c
lea eax, [ebp - 0x1160]
mov edx, 0x2c
call fcn.004095cc
lea eax, [ebp - 0x10b0]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x10a8]
call fcn.0040956c
lea eax, [ebp - 0x10a4]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x109c]
mov edx, 3
call fcn.004095cc
lea eax, [ebp - 0x1090]
call fcn.0040956c
lea eax, [ebp - 0x108c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x4a]
mov edx, dword [0x620f94]
call fcn.0040aa44
lea eax, [ebp - 0x14]
mov edx, dword [0x64d25c]
call fcn.0040aa44
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004095cc
ret