Function at 0x64c810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x64c818
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409650
lea eax, [ebp - 0x20]
mov edx, dword [0x64c774]
call fcn.0040a96c
mov ebx, 0x67e934
xor eax, eax
push ebp
push 0x64d762
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x64d774]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x64d784
mov edx, 0x64d798
mov eax, dword [ebp - 4]
call fcn.0042b814
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebx]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 7
jne 0x64d6cd
lea ecx, [ebp - 0x30]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
mov ecx, 1
mov eax, 0x64d7ac
call fcn.0040a710
test eax, eax
jle 0x64c8ba
cmp byte [0x67e8ea], 0
jne 0x64d6cd
lea ecx, [ebp - 0x34]
mov edx, 5
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x34]
mov ecx, 1
mov eax, 0x64d7c0
call fcn.0040a710
test eax, eax
jle 0x64c8ec
cmp byte [0x67e8ea], 0
je 0x64d6cd
lea ecx, [ebp - 0x3c]
mov edx, 3
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0042281c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00409994
mov eax, esi
dec ax
je 0x64c929
dec ax
je 0x64c93e
dec ax
je 0x64c953
dec ax
je 0x64c968
jmp 0x64c97b
mov eax, dword [ebp - 0x18]
mov edx, 0x64d7d4
call fcn.0040a4c8
jne 0x64d6cd
jmp 0x64c97b
mov eax, dword [ebp - 0x18]
mov edx, 0x64d808
call fcn.0040a4c8
jne 0x64d6cd
jmp 0x64c97b
mov eax, dword [ebp - 0x18]
mov edx, 0x64d84c
call fcn.0040a4c8
jne 0x64d6cd
jmp 0x64c97b
mov eax, dword [ebp - 0x18]
mov edx, 0x64d888
call fcn.0040a4c8
jne 0x64d6cd
cmp si, 5
jne 0x64c9c7
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0042281c
mov edx, dword [ebp - 0x40]
mov ecx, 1
mov eax, 0x64d8bc
call fcn.0040a710
test eax, eax
jle 0x64c9c7
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x20]
call fcn.00409994
jmp 0x64c9e9
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.00642f7c
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
call fcn.00409994
cmp si, 5
jne 0x64ca9c
lea ecx, [ebp - 0x58]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0042281c
mov edx, dword [ebp - 0x54]
mov ecx, 1
mov eax, 0x64d8e0
call fcn.0040a710
test eax, eax
jle 0x64ca9c
lea ecx, [ebp - 8]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, byte [0x64d8f8]
push eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x64d908
mov edx, 0x64d924
mov eax, dword [ebp - 8]
call fcn.0042b814
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.00642f7c
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 8]
call fcn.00409994
movzx eax, byte [0x64d8f8]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x64d948
mov edx, 0x64d96c
mov eax, dword [ebp - 8]
call fcn.0042b814
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x1c]
call fcn.00409994
jmp 0x64cac1
lea ecx, [ebp - 0x6c]
mov edx, 1
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.00642f7c
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x1c]
call fcn.00409994
cmp si, 5
jne 0x64cc69
mov eax, dword [ebp - 0x18]
mov edx, 0x64d988
call fcn.0040a4c8
jne 0x64cb44
push dword [ebp - 0x20]
push 0x64d9c0
push dword [ebp - 0x1c]
push 0x64d9d4
lea ecx, [ebp - 0x74]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x74]
push 0x64d9e8
lea ecx, [ebp - 0x78]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x78]
push 0x64d9fc
lea ecx, [ebp - 0x7c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x70]
mov eax, 0x64da10
call fcn.00644dc4
mov eax, dword [ebp - 0x18]
mov edx, 0x64da48
call fcn.0040a4c8
jne 0x64cbcf
push dword [ebp - 0x20]
push 0x64da80
push dword [ebp - 0x1c]
push 0x64da94
lea ecx, [ebp - 0x84]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x84]
push 0x64daa8
lea ecx, [ebp - 0x88]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x88]
push 0x64dabc
lea ecx, [ebp - 0x8c]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x8c]
lea eax, [ebp - 0x80]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x80]
mov eax, 0x64dad0
call fcn.00644dc4
mov eax, dword [ebp - 0x18]
mov edx, 0x64db04
call fcn.0040a4c8
jne 0x64d6cd
push dword [ebp - 0x20]
push 0x64db3c
push dword [ebp - 0x1c]
push 0x64db50
lea ecx, [ebp - 0x94]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x94]
push 0x64db64
lea ecx, [ebp - 0x98]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x98]
push 0x64db78
lea ecx, [ebp - 0x9c]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x9c]
lea eax, [ebp - 0x90]
mov edx, 9
call fcn.0040a418
mov edx, dword [ebp - 0x90]
mov eax, 0x64db8c
call fcn.00644dc4
jmp 0x64d6cd
lea ecx, [ebp - 0xa4]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0042281c
mov ecx, dword [ebp - 0xa0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
mov word [ebp - 0x14], 1
lea ecx, [ebp - 0xa8]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xa8]
mov edx, 0x64dbc0
call fcn.0040a4c8
jne 0x64ccd0
mov word [ebp - 0x14], 3
jmp 0x64cd26
lea ecx, [ebp - 0xac]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xac]
mov edx, 0x64dbe0
call fcn.0040a4c8
jne 0x64ccfc
mov word [ebp - 0x14], 2
jmp 0x64cd26
lea ecx, [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb0]
mov edx, 0x64dc00
call fcn.0040a4c8
jne 0x64cd26
mov word [ebp - 0x14], 0
lea ecx, [ebp - 0xb8]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.0042281c
mov ecx, dword [ebp - 0xb4]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xbc]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xbc]
mov edx, 0x64dc18
call fcn.0040a4c8
je 0x64cda7
lea ecx, [ebp - 0xc0]
mov edx, 4
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc0]
mov edx, 0x64dc2c
call fcn.0040a4c8
je 0x64cda7
xor eax, eax
jmp 0x64cda9
mov al, 1
mov byte [ebp - 0x12], al
lea ecx, [ebp - 0xc8]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.0042281c
mov ecx, dword [ebp - 0xc4]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0x20]
lea ecx, [ebp - 0xcc]
mov edx, 6
mov eax, dword [ebx]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xcc]
mov edx, 0x64dc3c
call fcn.0040a4c8
je 0x64ce2d
lea ecx, [ebp - 0xd0]
mov edx, 6
mov eax, dword [ebx]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xd0]
mov edx, 0x64dc50
call fcn.0040a4c8
je 0x64ce2d
xor eax, eax
jmp 0x64ce2f
mov al, 1
mov byte [ebp - 0x11], al
mov byte [0x67e8eb], 0
mov byte [0x67e8ee], 0
mov esi, dword [ebp - 0x20]
mov eax, esi
test eax, eax
je 0x64ce4e
sub eax, 4
mov eax, dword [eax]
cmp eax, 5
jle 0x64d24f
lea eax, [ebp - 0xd8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040a500
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.0042281c
mov eax, dword [ebp - 0xd4]
mov edx, 0x64dc60
call fcn.0040a4c8
jne 0x64d24f
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x64dc74
call fcn.0040a710
test eax, eax
jle 0x64d24f
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x64dc84
call fcn.0040a710
test eax, eax
jle 0x64d24f
mov ebx, esi
test ebx, ebx
je 0x64ced6
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 3
mov edx, 4
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x64dc94
call fcn.0040a710
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040a500
mov ebx, esi
test ebx, ebx
je 0x64cf1d
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, 1
mov edx, dword [ebp - 0x20]
mov eax, 0x64dca4
call fcn.0040a710
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x20]
call fcn.0040a500
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 8]
call fcn.00642f7c
mov edx, dword [ebp - 0xdc]
lea eax, [ebp - 8]
call fcn.00409994
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0xc]
call fcn.00642f7c
mov edx, dword [ebp - 0xe0]
lea eax, [ebp - 0xc]
call fcn.00409994
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040a4c8
jne 0x64d6cd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64cf95
sub eax, 4
mov eax, dword [eax]
cmp eax, 4
jle 0x64d6cd
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00409994
lea eax, [ebp - 0xe8]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.0042281c
mov eax, dword [ebp - 0xe4]
mov edx, 0x64dcb4
call fcn.0040a4c8
je 0x64d061
lea eax, [ebp - 0xf0]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.0042281c
mov eax, dword [ebp - 0xec]
mov edx, 0x64dccc
call fcn.0040a4c8
je 0x64d061
lea eax, [ebp - 0xf8]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.0042281c
mov eax, dword [ebp - 0xf4]
mov edx, 0x64dce4
call fcn.0040a4c8
jne 0x64d6cd
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov eax, 0x64dcfc
call fcn.0040a710
mov ecx, eax
lea eax, [ebp - 0x10]
mov edx, 1
call fcn.0040a548
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x64d08e
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.0040a500
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x10]
call fcn.00642f7c
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 0x10]
call fcn.00409994
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.0042281c
mov eax, dword [ebp - 0x100]
mov edx, 0x64dd0c
call fcn.0040a4c8
jne 0x64d138
cmp byte [0x67e8e2], 0
jne 0x64d138
push 0x40040
lea edx, [ebp - 0x108]
mov eax, dword [0x67e8a4]
call fcn.00541928
mov eax, dword [ebp - 0x108]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x6784f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0042281c
mov eax, dword [ebp - 0x10c]
mov edx, 0x64dd1c
call fcn.0040a4c8
jne 0x64d1bf
cmp dword [ebp - 0x10], 0
je 0x64d1b8
cmp byte [0x67e8e2], 0
jne 0x64d1b8
push 0x40030
lea edx, [ebp - 0x114]
mov eax, dword [0x67e8a4]
call fcn.00541928
mov eax, dword [ebp - 0x114]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x6784f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x67e8eb], 1
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x1c]
movzx edx, word [edx]
call fcn.0040a164
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0042281c
mov eax, dword [ebp - 0x118]
mov edx, 0x64dd2c
call fcn.0040a4c8
jne 0x64d6cd
cmp dword [ebp - 0x10], 0
je 0x64d243
cmp byte [0x67e8e2], 0
jne 0x64d243
push 0x40030
lea edx, [ebp - 0x120]
mov eax, dword [0x67e8a4]
call fcn.00541928
mov eax, dword [ebp - 0x120]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a13c
push eax
mov eax, dword [0x6784f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
mov byte [0x67e8ee], 1
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64dd3c
jne 0x64d25d
mov al, 1
jmp 0x64d282
cmp dword [ebp - 0x20], 0
je 0x64d26c
mov eax, 0x64dd58
test eax, eax
jne 0x64d270
xor eax, eax
jmp 0x64d282
mov edx, 0x64dd74
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d3b3
mov ecx, 1
mov edx, dword [ebp - 0x1c]
mov eax, 0x64dd90
call fcn.0040a710
test eax, eax
jle 0x64d2cc
movzx eax, byte [0x64d774]
push eax
lea eax, [ebp - 0x124]
push eax
xor ecx, ecx
mov edx, 0x64dda0
mov eax, dword [ebp - 0x1c]
call fcn.0042b814
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x1c]
call fcn.00409994
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.004241e8
test al, al
je 0x64d6cd
mov byte [ebp - 0x25], 0
mov dl, 1
mov eax, dword [0x48feb4]
call fcn.004b3864
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x64d370
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x128]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x128]
mov ecx, 1
mov eax, 0x64ddb0
call fcn.0040a710
test eax, eax
jle 0x64d36c
mov byte [ebp - 0x25], 1
lea ecx, [ebp - 0x130]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00642f7c
mov ecx, dword [ebp - 0x12c]
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x64d30e
cmp byte [ebp - 0x25], 0
je 0x64d3a6
xor eax, eax
push ebp
push 0x64d39c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d3a6
mov eax, dword [ebp - 0x24]
call fcn.004078f0
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64ddc0
jne 0x64d3c1
mov al, 1
jmp 0x64d3e6
cmp dword [ebp - 0x20], 0
je 0x64d3d0
mov eax, 0x64dde8
test eax, eax
jne 0x64d3d4
xor eax, eax
jmp 0x64d3e6
mov edx, 0x64de10
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d3fd
cmp dword [ebp - 0x1c], 0
je 0x64d3fd
mov eax, dword [ebp - 0x1c]
call fcn.00424df8
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x64d409
sub eax, 4
mov eax, dword [eax]
cmp eax, 7
jle 0x64d522
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x20]
call fcn.0042281c
mov eax, dword [ebp - 0x138]
mov ecx, 6
mov edx, 1
call fcn.0040a500
mov eax, dword [ebp - 0x134]
mov edx, 0x64de38
call fcn.0040a4c8
jne 0x64d522
cmp dword [ebp - 0x1c], 0
je 0x64d522
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.00409994
lea eax, [ebp - 8]
mov ecx, 6
mov edx, 1
call fcn.0040a548
mov edx, dword [ebp - 8]
mov eax, edx
test eax, eax
je 0x64d487
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
cmp word [ecx + eax*2 - 2], 0x29
jne 0x64d4ab
mov eax, edx
test eax, eax
je 0x64d49d
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 8]
mov ecx, 1
xchg edx, eax
call fcn.0040a548
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 8]
call fcn.00642f7c
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 8]
call fcn.00409994
push 0x40024
lea edx, [ebp - 0x140]
mov eax, dword [0x67e8a4]
call fcn.00541928
mov eax, dword [ebp - 0x140]
call fcn.0040a13c
push eax
mov eax, dword [ebp - 8]
call fcn.0040a13c
push eax
mov eax, dword [0x6784f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 6
jne 0x64d6cd
push 0
xor ecx, ecx
movzx edx, byte [ebp - 0x12]
mov eax, dword [ebp - 0x1c]
call fcn.0064c278
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64de54
jne 0x64d530
mov al, 1
jmp 0x64d555
cmp dword [ebp - 0x20], 0
je 0x64d53f
mov eax, 0x64de88
test eax, eax
jne 0x64d543
xor eax, eax
jmp 0x64d555
mov edx, 0x64debc
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d56e
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64def0
jne 0x64d57c
mov al, 1
jmp 0x64d5a1
cmp dword [ebp - 0x20], 0
je 0x64d58b
mov eax, 0x64df28
test eax, eax
jne 0x64d58f
xor eax, eax
jmp 0x64d5a1
mov edx, 0x64df60
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d5b7
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64df98
jne 0x64d5c5
mov al, 1
jmp 0x64d5ea
cmp dword [ebp - 0x20], 0
je 0x64d5d4
mov eax, 0x64dfc0
test eax, eax
jne 0x64d5d8
xor eax, eax
jmp 0x64d5ea
mov edx, 0x64dfe8
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d603
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageW
jmp 0x64d6cd
mov eax, dword [ebp - 0x20]
cmp eax, 0x64e010
jne 0x64d611
mov al, 1
jmp 0x64d636
cmp dword [ebp - 0x20], 0
je 0x64d620
mov eax, 0x64e040
test eax, eax
jne 0x64d624
xor eax, eax
jmp 0x64d636
mov edx, 0x64e070
mov eax, dword [ebp - 0x20]
call fcn.004229bc
test eax, eax
sete al
test al, al
je 0x64d67a
xor eax, eax
push ebp
push 0x64d66e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1388
push 2
push 0x64e094
push 0
push 0x1a
push 0xffff
call sub.user32.dll_SendMessageTimeoutW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x64d6cd
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.004241e8
test al, al
je 0x64d6a6
movzx eax, word [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
xor eax, eax
call fcn.0064a800
jmp 0x64d6c1
movzx eax, word [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
call fcn.0040a13c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x6784f0]
mov eax, dword [eax]
call fcn.00615f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64d76c
lea eax, [ebp - 0x140]
call fcn.0040956c
lea eax, [ebp - 0x13c]
mov edx, 7
call fcn.004095cc
lea eax, [ebp - 0x120]
call fcn.0040956c
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x114]
call fcn.0040956c
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.004095cc
lea eax, [ebp - 0x108]
call fcn.0040956c
lea eax, [ebp - 0x104]
mov edx, 0x37
call fcn.004095cc
lea eax, [ebp - 0x20]
mov edx, dword [0x64c774]
call fcn.0040aa44
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004095cc
ret