Function at 0x84ef40
Capabilities:
Change the wallpaper
Copy file
Persist via run registry key

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5b8
mov rbp, rsp
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x250], 0
mov qword [rbp + 0x258], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 0
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2d8], 0
mov qword [rbp + 0x2e0], 0
mov qword [rbp + 0x2e8], 0
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x310], 0
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x328], 0
mov qword [rbp + 0x330], 0
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x350], 0
lea rdi, [rbp + 0x358]
xor eax, eax
mov ecx, 6
rep stosq qword [rdi], rax
lea rdi, [rbp + 0x388]
xor eax, eax
mov ecx, 6
rep stosq qword [rdi], rax
mov qword [rbp + 0x3b8], 0
mov qword [rbp + 0x3c0], 0
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x3e8], 0
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 0
mov qword [rbp + 0x418], 0
mov qword [rbp + 0x420], 0
mov qword [rbp + 0x428], 0
mov qword [rbp + 0x438], 0
mov qword [rbp + 0x430], 0
mov qword [rbp + 0x448], 0
mov qword [rbp + 0x440], 0
mov qword [rbp + 0x458], 0
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x468], 0
mov qword [rbp + 0x460], 0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x478], 0
mov qword [rbp + 0x480], 0
mov qword [rbp + 0x488], 0
mov qword [rbp + 0x490], 0
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4c0], 0
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4f0], 0
mov qword [rbp + 0x4e8], 0
mov qword [rbp + 0x4e0], 0
mov qword [rbp + 0x4d8], 0
mov qword [rbp + 0x518], 0
mov qword [rbp + 0x510], 0
mov qword [rbp + 0x508], 0
mov qword [rbp + 0x500], 0
mov qword [rbp + 0x4f8], 0
mov qword [rbp + 0x520], 0
mov qword [rbp + 0x588], 0
mov qword [rbp + 0x580], 0
mov qword [rbp + 0x578], 0
mov qword [rbp + 0x570], 0
mov qword [rbp + 0x568], 0
mov qword [rbp + 0x560], 0
mov qword [rbp + 0x558], 0
mov qword [rbp + 0x550], 0
mov qword [rbp + 0x528], rbp
nop
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x520]
lea r8, [0x00851eb8]
lea r9, [0x00851ed4]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x520]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x84fa7d
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x510]
lea r8, [0x00851eb8]
lea r9, [0x00851f48]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x508]
lea r8, [0x00851eb8]
lea r9, [0x00851f7c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x500]
lea r8, [0x00851eb8]
lea r9, [0x00851fa0]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4f8]
lea r8, [0x00851eb8]
lea r9, [0x00851fbc]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [rbp + 0x518]
mov edx, 8
lea r8, [0x00851f08]
mov r9, qword [rbp + 0x510]
lea rax, [0x00851f6c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [0x00851f6c]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x500]
mov qword [rsp + 0x38], rax
lea rax, [0x00851f6c]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rsp + 0x48], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x518]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4f0]
lea r8, [0x00851eb8]
lea r9, [0x00851f48]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
cmp qword [rbp + 0x4f0], 0
je 0x84fa64
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4e8]
lea r8, [0x00851eb8]
lea r9, [0x00851f7c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
cmp qword [rbp + 0x4e8], 0
je 0x84fa64
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4e0]
lea r8, [0x00851eb8]
lea r9, [0x00851fa0]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
cmp qword [rbp + 0x4e0], 0
je 0x84fa64
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4d8]
lea r8, [0x00851eb8]
lea r9, [0x00851fbc]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
cmp qword [rbp + 0x4d8], 0
je 0x84fa64
nop
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4d0]
lea r8, [0x00851eb8]
lea r9, [0x00851f48]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x4d0]
call fcn.00432ee0
mov dword [rbp + 0x5a0], eax
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4c8]
lea r8, [0x00851eb8]
lea r9, [0x00851f7c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x4c8]
call fcn.00432ee0
mov dword [rbp + 0x59c], eax
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4c0]
lea r8, [0x00851eb8]
lea r9, [0x00851fa0]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x4c0]
call fcn.00432ee0
mov dword [rbp + 0x598], eax
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4b8]
lea r8, [0x00851eb8]
lea r9, [0x00851fbc]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x4b8]
call fcn.00432ee0
mov dword [rbp + 0x594], eax
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 5
jle 0x84f9b1
mov ecx, dword [rbp + 0x5a0]
mov edx, dword [rbp + 0x59c]
mov r8d, dword [rbp + 0x598]
mov r9d, dword [rbp + 0x594]
call fcn.0084d0a0
mov dword [rbp + 0x54c], eax
cmp dword [rbp + 0x54c], 0
je 0x84f9d6
mov ecx, 0xbb8
call sub.KERNEL32.DLL_Sleep_2
mov ecx, dword [rbp + 0x5a0]
mov edx, dword [rbp + 0x59c]
mov r8d, dword [rbp + 0x598]
mov r9d, dword [rbp + 0x594]
call fcn.0084d0a0
mov dword [rbp + 0x54c], eax
jmp 0x84f9d6
mov ecx, dword [rbp + 0x5a0]
mov edx, dword [rbp + 0x59c]
mov r8d, dword [rbp + 0x598]
mov r9d, dword [rbp + 0x594]
call fcn.0084d0a0
mov dword [rbp + 0x54c], eax
cmp dword [rbp + 0x54c], 0
je 0x84fa26
lea rcx, [rbp + 0x4a8]
mov edx, dword [rbp + 0x54c]
call fcn.00432c30
lea rcx, [rbp + 0x4b0]
lea rdx, [0x00851fe4]
mov r8, qword [rbp + 0x4a8]
call fcn.00410bc0
mov rcx, qword [rbp + 0x4b0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x84fa7d
lea rcx, [0x0085203c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x84fa7d
lea rcx, [0x008520d4]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 5
jle 0x84fb3c
mov rcx, 0xffffffff80000002
lea rdx, [0x00852108]
lea r8, [0x00852188]
mov r9d, 0xf003f
call fcn.006f7180
mov dword [rbp + 0x5a8], eax
cmp dword [rbp + 0x5a8], 0xffffffff
je 0x84fb5e
mov rcx, 0xffffffff80000002
lea rdx, [0x00852108]
lea r8, [0x008521a4]
mov r9d, 0xf003f
call fcn.006f7180
cmp eax, dword [rbp + 0x5a8]
je 0x84fb19
mov rcx, 0xffffffff80000002
lea rdx, [0x00852108]
lea r8, [0x008521a4]
mov r9d, dword [rbp + 0x5a8]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000002
lea rdx, [0x00852108]
lea r8, [0x00852188]
mov r9d, 0xf003f
call fcn.006f6e10
jmp 0x84fb5e
lea rcx, [0x008521c4]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov cl, 1
mov dl, 1
call fcn.0084c320
call fcn.007ca6c0
test al, al
jne 0x84fb80
lea rcx, [0x00852218]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x4a0]
lea r8, [0x00851eb8]
lea r9, [0x0085225c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x4a0]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x84fbe6
lea rcx, [0x00852280]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
call fcn.007cd850
call fcn.007ca840
cmp al, 1
jne 0x84fc5d
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x498]
lea r8, [0x00851eb8]
lea r9, [0x008522c4]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x498]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x84fc5d
lea rcx, [rbp + 0x490]
lea rdx, [0x008522d6]
call fcn.00410800
mov rcx, qword [rbp + 0x490]
xor rdx, rdx
xor r8, r8
call fcn.00721460
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x488]
lea r8, [0x00851eb8]
lea r9, [0x00852320]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x488]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x84fdd9
lea rcx, [0x0085234c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x588]
call fcn.0040ef50
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 6
jge 0x84fd5f
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x588]
lea r8, [0x0085239c]
lea r9, [0x008523c8]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [rbp + 0x480]
lea rdx, [0x008523e0]
mov r8, qword [rbp + 0x588]
call fcn.00410bc0
mov rcx, qword [rbp + 0x480]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
cmp qword [rbp + 0x588], 0
je 0x84fdd9
mov rcx, qword [rbp + 0x588]
call fcn.007ea0c0
jmp 0x84fdd9
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x588]
lea r8, [0x00852430]
lea r9, [0x008523c8]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
lea rcx, [rbp + 0x478]
lea rdx, [0x008523e0]
mov r8, qword [rbp + 0x588]
call fcn.00410bc0
mov rcx, qword [rbp + 0x478]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
cmp qword [rbp + 0x588], 0
je 0x84fdd9
mov rcx, qword [rbp + 0x588]
call fcn.007ea0c0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x470]
lea r8, [0x00851eb8]
lea r9, [0x0085245c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x470]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x850009
lea rcx, [rbp + 0x580]
mov rdx, 0xffffffff80000001
lea r8, [0x00852488]
lea r9, [0x00852518]
mov dword [rsp + 0x20], 0xf003f
call fcn.006f7090
lea rcx, [0x00852538]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rcx, qword [rbp + 0x580]
mov dl, 1
call fcn.00433b80
test al, al
je 0x84ff81
lea rcx, [rbp + 0x460]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x468]
mov edx, 3
mov r8, qword [rbp + 0x460]
lea r9, [0x008525a0]
lea rax, [0x008525c4]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x468]
mov dl, 1
call fcn.00433a90
test al, al
je 0x84ff81
mov rcx, qword [rbp + 0x580]
mov edx, 1
call fcn.008137d0
mov rcx, qword [rbp + 0x580]
lea rdx, [0x008525e8]
mov r8d, 1
call fcn.00813650
lea rcx, [rbp + 0x450]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x458]
mov edx, 3
mov r8, qword [rbp + 0x450]
lea r9, [0x008525a0]
lea rax, [0x008525c4]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x458]
lea rdx, [0x008525fc]
mov r8, qword [rbp + 0x580]
lea r9, [0x00852628]
call fcn.00812a00
test al, al
jne 0x84fffd
lea rcx, [0x0085263c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x84fffd
lea rcx, [rbp + 0x440]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x448]
mov edx, 6
lea r8, [0x00852690]
mov r9, qword [rbp + 0x580]
lea rax, [0x00851f6c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x440]
mov qword [rsp + 0x28], rax
lea rax, [0x008525a0]
mov qword [rsp + 0x30], rax
lea rax, [0x008525c4]
mov qword [rsp + 0x38], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x448]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [0x008525c4]
call fcn.00434230
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 6
jge 0x8500c8
lea rcx, [rbp + 0x438]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x438]
lea rdx, [0x008526e8]
call fcn.00410ad0
mov rcx, qword [rbp + 0x438]
call fcn.00410760
lea rcx, [rbp + 0x430]
mov rdx, rax
call fcn.00410800
mov rcx, qword [rbp + 0x430]
call fcn.00434230
mov rcx, 0xffffffff80000001
lea rdx, [0x00852728]
lea r8, [0x00852790]
lea r9, [0x008527b0]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7880
mov rcx, 0xffffffff80000001
lea rdx, [0x00852728]
lea r8, [0x008527d0]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
jmp 0x850152
mov rcx, 0xffffffff80000001
lea rdx, [0x008527fc]
lea r8, [0x0085285c]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000001
lea rdx, [0x008527fc]
lea r8, [0x00852888]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000002
lea rdx, [0x008528b4]
lea r8, [0x00852914]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x428]
lea r8, [0x00851eb8]
lea r9, [0x00852954]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x428]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x850243
lea rcx, [0x0085297c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x420]
lea r8, [0x00851eb8]
lea r9, [0x008529d8]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x420]
lea rdx, [0x00852a0c]
call fcn.00410dc0
test eax, eax
jne 0x850206
call fcn.007cea00
jmp 0x850243
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x418]
lea r8, [0x00851eb8]
lea r9, [0x00852a1c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x418]
call fcn.007cf580
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x410]
lea r8, [0x00851eb8]
lea r9, [0x00852a50]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x410]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x850334
lea rcx, [0x00852a78]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x408]
lea r8, [0x00851eb8]
lea r9, [0x00852ad4]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x408]
lea rdx, [0x00852a0c]
call fcn.00410dc0
test eax, eax
jne 0x8502f7
call fcn.007d0320
jmp 0x850334
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x400]
lea r8, [0x00851eb8]
lea r9, [0x00852a1c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x400]
call fcn.007d0ae0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x3f8]
lea r8, [0x00851eb8]
lea r9, [0x00852b08]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x3f8]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x85039d
lea rcx, [0x00852b2c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
xor rcx, rcx
call fcn.0084ccb0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x3f0]
lea r8, [0x00851eb8]
lea r9, [0x00852b84]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x3f0]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x850409
lea rcx, [0x00852bac]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov ecx, 1
call fcn.0084ccb0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x3e8]
lea r8, [0x00851eb8]
lea r9, [0x00852c08]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x3e8]
lea rdx, [0x00852a0c]
call fcn.00410dc0
test eax, eax
je 0x8505dd
lea rcx, [rbp + 0x3e0]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0x3e0]
lea rdx, [0x00852c28]
call fcn.00410dc0
test eax, eax
jne 0x8505dd
call fcn.0084bb50
test al, al
je 0x8504ae
lea rcx, [0x00852c40]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x8505dd
lea rcx, [0x00852ca8]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rcx, 0xffffffff80000001
lea rdx, [0x00852cfc]
lea r8, [0x00852d48]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000001
lea rdx, [0x00852cfc]
lea r8, [0x00852d6c]
xor r9, r9
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000001
lea rdx, [0x00852cfc]
lea r8, [0x00852da8]
mov r9d, 2
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
mov rcx, 0xffffffff80000001
lea rdx, [0x00852cfc]
lea r8, [0x00852dd8]
mov r9d, 1
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
call fcn.006f7560
lea rcx, [0x00852e04]
call fcn.00720920
lea rcx, [rbp + 0x3d8]
lea rdx, [0x00852e10]
call fcn.00410800
mov rcx, qword [rbp + 0x3d8]
or edx, 0xffffffff
xor r8, r8
call fcn.00721460
lea rcx, [0x00852e04]
call fcn.00720790
lea rcx, [rbp + 0x3d0]
lea rdx, [0x00852e3c]
call fcn.00410800
mov rcx, qword [rbp + 0x3d0]
or edx, 0xffffffff
xor r8, r8
call fcn.00721460
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x3c8]
lea r8, [0x00851eb8]
lea r9, [0x00852e78]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x3c8]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
je 0x850671
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x3c0]
lea r8, [0x00851eb8]
lea r9, [0x00852e94]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x3c0]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x851b91
lea rcx, [rbp + 0x3b8]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0x3b8]
lea rdx, [0x00852eb4]
call fcn.00410dc0
test eax, eax
jne 0x8506e9
call fcn.006fbf70
test al, al
jne 0x8506e9
lea rcx, [0x00852ecc]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
lea rcx, [rbp + 0x388]
call fcn.0084abe0
lea rcx, [0x008d5d00]
lea rdx, [rbp + 0x388]
mov r8, qword [0x00849cc8]
call fcn.00411a10
jmp 0x850728
lea rcx, [0x00852f34]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
lea rcx, [rbp + 0x358]
call fcn.00849e00
lea rcx, [0x008d5d00]
lea rdx, [rbp + 0x358]
mov r8, qword [0x00849cc8]
call fcn.00411a10
lea rcx, [0x008d5d30]
mov rdx, qword [0x008d5d00]
call fcn.0040f580
lea rcx, [0x008d5d38]
mov rdx, qword [0x008d5d08]
call fcn.0040f580
lea rcx, [0x008d5d48]
mov rdx, qword [0x008d5d10]
call fcn.0040f580
lea rcx, [0x008d5d40]
mov rdx, qword [0x008d5d18]
call fcn.0040f580
lea rcx, [0x008d5d50]
mov rdx, qword [0x008d5d20]
call fcn.0040f580
lea rcx, [0x008d5d58]
mov rdx, qword [0x008d5d28]
call fcn.0040f580
lea rcx, [rbp + 0x350]
lea rdx, [0x00852fa4]
mov r8, qword [0x008d5d38]
call fcn.00410bc0
mov rcx, qword [rbp + 0x350]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
lea rcx, [rbp + 0x348]
lea rdx, [0x0085301c]
mov r8, qword [0x008d5d48]
call fcn.00410bc0
mov rcx, qword [rbp + 0x348]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
lea rcx, [rbp + 0x560]
mov rdx, qword [0x008d5d38]
call fcn.00819070
lea rcx, [rbp + 0x338]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x340]
mov edx, 3
mov r8, qword [rbp + 0x338]
lea r9, [0x0085309c]
mov rax, qword [rbp + 0x560]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x340]
mov dl, 1
call fcn.00433b80
test al, al
je 0x851afb
lea rcx, [rbp + 0x330]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x558]
mov edx, 4
mov r8, qword [rbp + 0x330]
lea r9, [0x0085309c]
mov rax, qword [rbp + 0x560]
mov qword [rsp + 0x20], rax
lea rax, [0x008530c0]
mov qword [rsp + 0x28], rax
call fcn.00410ce0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x328]
lea r8, [0x00851eb8]
lea r9, [0x00852e94]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x328]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x8512ef
lea rcx, [rbp + 0x320]
mov rdx, qword [rbp + 0x558]
lea r8, [0x008530d0]
call fcn.00410bc0
mov rcx, qword [rbp + 0x320]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850afa
lea rcx, [rbp + 0x318]
mov edx, 3
lea r8, [0x008530ec]
mov r9, qword [rbp + 0x558]
lea rax, [0x008530d0]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x318]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x310]
mov rdx, qword [rbp + 0x558]
lea r8, [0x008530d0]
call fcn.00410bc0
mov rcx, qword [rbp + 0x310]
call fcn.00410760
mov rbx, rax
lea rcx, [rbp + 0x308]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x308]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x308]
call fcn.00410760
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.KERNEL32.DLL_CopyFileW
lea rcx, [rbp + 0x300]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x300]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x300]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850a72
nop
lea rcx, [rbp + 0x2f8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x2f8]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x2f8]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x2f0]
mov edx, 3
lea r8, [0x0085317c]
mov r9, qword [rbp + 0x558]
lea rax, [0x008530d0]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x2f0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x2e8]
mov rdx, qword [rbp + 0x558]
lea r8, [0x008530d0]
call fcn.00410bc0
mov rcx, qword [rbp + 0x2e8]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x2e0]
mov edx, 3
lea r8, [0x008531e0]
mov r9, qword [rbp + 0x558]
lea rax, [0x008530d0]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x2e0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 5
jle 0x850f4b
lea rcx, [rbp + 0x2d8]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085324c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x2d8]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850d59
lea rcx, [rbp + 0x2d0]
mov edx, 3
lea r8, [0x00853268]
mov r9, qword [rbp + 0x558]
lea rax, [0x0085324c]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x2d0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x2c8]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085324c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x2c8]
call fcn.00410760
mov rbx, rax
lea rcx, [rbp + 0x2c0]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x2c0]
lea rdx, [0x008532d4]
call fcn.00410ad0
mov rcx, qword [rbp + 0x2c0]
call fcn.00410760
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.KERNEL32.DLL_CopyFileW
lea rcx, [rbp + 0x2b8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x2b8]
lea rdx, [0x008532d4]
call fcn.00410ad0
mov rcx, qword [rbp + 0x2b8]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850cc3
nop
lea rcx, [rbp + 0x2b0]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x2b0]
lea rdx, [0x008532d4]
call fcn.00410ad0
mov rcx, qword [rbp + 0x2b0]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x2a8]
mov edx, 3
lea r8, [0x00853300]
mov r9, qword [rbp + 0x558]
lea rax, [0x0085324c]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x2a8]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
nop
lea rcx, [rbp + 0x2a0]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085324c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x2a0]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x298]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085336c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x298]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850f13
lea rcx, [rbp + 0x290]
mov edx, 3
lea r8, [0x00853388]
mov r9, qword [rbp + 0x558]
lea rax, [0x0085336c]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x290]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x288]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085336c]
call fcn.00410bc0
lea rcx, [rbp + 0x280]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x280]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x288]
mov rdx, qword [rbp + 0x280]
call fcn.0084ba80
lea rcx, [rbp + 0x278]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x278]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x278]
mov dl, 1
call fcn.00433a90
test al, al
je 0x850eb6
nop
lea rcx, [rbp + 0x270]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x270]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x270]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x260]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x268]
mov edx, 3
lea r8, [0x008533f4]
mov r9, qword [rbp + 0x260]
lea rax, [0x00853150]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x268]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x8512ef
lea rcx, [rbp + 0x258]
lea rdx, [0x00853474]
mov r8, qword [rbp + 0x558]
call fcn.00410bc0
mov rcx, qword [rbp + 0x258]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x8512ef
lea rcx, [rbp + 0x250]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085324c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x250]
mov dl, 1
call fcn.00433a90
test al, al
je 0x851105
lea rcx, [rbp + 0x248]
mov edx, 3
lea r8, [0x008534fc]
mov r9, qword [rbp + 0x558]
lea rax, [0x0085324c]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x248]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x240]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085324c]
call fcn.00410bc0
lea rcx, [rbp + 0x238]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x238]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x240]
mov rdx, qword [rbp + 0x238]
call fcn.0084b9b0
lea rcx, [rbp + 0x230]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x230]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x230]
mov dl, 1
call fcn.00433a90
test al, al
je 0x8510a8
nop
lea rcx, [rbp + 0x228]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x228]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x228]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x218]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x220]
mov edx, 3
lea r8, [0x00853564]
mov r9, qword [rbp + 0x218]
lea rax, [0x00853150]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x220]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x8512ef
lea rcx, [rbp + 0x210]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085336c]
call fcn.00410bc0
mov rcx, qword [rbp + 0x210]
mov dl, 1
call fcn.00433a90
test al, al
je 0x8512bc
lea rcx, [rbp + 0x208]
mov edx, 3
lea r8, [0x008535d8]
mov r9, qword [rbp + 0x558]
lea rax, [0x0085336c]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x208]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0x200]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085336c]
call fcn.00410bc0
lea rcx, [rbp + 0x1f8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x1f8]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x1f8]
call fcn.0084ba80
lea rcx, [rbp + 0x1f0]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x1f0]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x1f0]
mov dl, 1
call fcn.00433a90
test al, al
je 0x851262
nop
lea rcx, [rbp + 0x1e8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x1e8]
lea rdx, [0x00853150]
call fcn.00410ad0
mov rcx, qword [rbp + 0x1e8]
call fcn.00410760
mov ecx, 0x14
xor rdx, rdx
mov r8, rax
mov r9d, 1
call sub.user32.dll_SystemParametersInfoW
jmp 0x8512ef
lea rcx, [rbp + 0x1d8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0x1e0]
mov edx, 3
lea r8, [0x00853644]
mov r9, qword [rbp + 0x1d8]
lea rax, [0x00853150]
mov qword [rsp + 0x20], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
jmp 0x8512ef
lea rcx, [rbp + 0x1d0]
lea rdx, [0x008536c4]
mov r8, qword [rbp + 0x558]
call fcn.00410bc0
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0x1c8]
lea r8, [0x00851eb8]
lea r9, [0x00852e78]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0x1c8]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x851b5f
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 6
jge 0x85172a
mov rax, qword [0x008c9db0]
cmp dword [rax], 0x804
je 0x851377
lea rcx, [rbp + 0x550]
mov rdx, qword [rbp + 0x558]
lea r8, [0x0085374c]
call fcn.00410bc0
jmp 0x851391
lea rcx, [rbp + 0x550]
mov rdx, qword [rbp + 0x558]
lea r8, [0x00853770]
call fcn.00410bc0
mov rcx, qword [0x004df008]
mov dl, 1
call fcn.00511b30
mov qword [rbp + 0x540], rax
lea rcx, [0x0085378c]
mov rdx, qword [rbp + 0x550]
lea r8, [rbp + 0x540]
call fcn.006fd750
mov rcx, qword [0x004df008]
mov dl, 1
call fcn.00511b30
mov qword [rbp + 0x538], rax
mov rcx, qword [rbp + 0x540]
mov rax, qword [rbp + 0x540]
mov rax, qword [rax]
call qword [rax + 0x28]
xor rcx, rcx
mov ebx, eax
sub ebx, 1
mov dword [rbp + 0x5a4], ecx
cmp dword [rbp + 0x5a4], ebx
jg 0x851474
add ebx, 1
mov rcx, qword [rbp + 0x540]
lea rdx, [rbp + 0x1b8]
mov r8d, dword [rbp + 0x5a4]
mov rax, qword [rbp + 0x540]
mov rsi, qword [rax]
call qword [rsi + 0x18]
lea rcx, [rbp + 0x1c0]
lea rdx, [0x0085378c]
mov r8, qword [rbp + 0x1b8]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
mov rcx, qword [rbp + 0x538]
mov rdx, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x538]
mov rax, qword [rax]
call qword [rax + 0x78]
add dword [rbp + 0x5a4], 1
cmp dword [rbp + 0x5a4], ebx
jne 0x851402
nop
lea rcx, [rbp + 0x1a8]
lea rdx, [0x00853824]
lea r8, [0x0085383c]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x1a0]
lea rdx, [0x00853824]
lea r8, [0x00853878]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x198]
lea rdx, [0x008538c0]
lea r8, [0x008538dc]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x190]
lea rdx, [0x008538c0]
lea r8, [0x00853924]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x1b0]
mov edx, 0xe
lea r8, [0x008537c0]
mov r9, qword [rbp + 0x1a8]
lea rax, [0x00853854]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [0x00853894]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x38], rax
lea rax, [0x00853904]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x48], rax
lea rax, [0x0085393c]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x558]
mov qword [rsp + 0x58], rax
lea rax, [0x00853958]
mov qword [rsp + 0x60], rax
lea rax, [0x00853974]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x558]
mov qword [rsp + 0x70], rax
lea rax, [0x00853990]
mov qword [rsp + 0x78], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0x1b0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
lea rcx, [rbp + 0x188]
lea rdx, [0x00853824]
lea r8, [0x0085383c]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x180]
lea rdx, [0x00853824]
lea r8, [0x00853878]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x178]
lea rdx, [0x00853824]
lea r8, [0x00853878]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x170]
lea rdx, [0x008538c0]
lea r8, [0x008538dc]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x168]
lea rdx, [0x008538c0]
lea r8, [0x00853924]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x558]
lea r8, [0x00853958]
call fcn.00410bc0
lea rcx, [rbp + 0x158]
mov rdx, qword [rbp + 0x558]
lea r8, [0x00853990]
call fcn.00410bc0
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x178]
lea r9, [0x008539ac]
mov rax, qword [rbp + 0x170]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x168]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x158]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x538]
mov qword [rsp + 0x40], rax
call fcn.00818590
jmp 0x851b5f
lea rcx, [rbp + 0x550]
mov rdx, qword [rbp + 0x558]
lea r8, [0x008539cc]
call fcn.00410bc0
mov rax, qword [0x008c9db0]
cmp dword [rax], 0x804
je 0x85186d
lea rcx, [rbp + 0x150]
lea rdx, [0x008539e8]
lea r8, [0x008538dc]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x148]
lea rdx, [0x008539e8]
lea r8, [0x00853924]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x140]
lea rdx, [0x00853a0c]
lea r8, [0x00853a28]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x138]
lea rdx, [0x00853a0c]
lea r8, [0x00853a3c]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x130]
lea rdx, [0x00853a0c]
lea r8, [0x00853a54]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x128]
mov rdx, qword [rbp + 0x558]
lea r8, [0x00853a68]
call fcn.00410bc0
mov rcx, qword [rbp + 0x150]
mov rdx, qword [rbp + 0x148]
mov r8, qword [rbp + 0x140]
mov r9, qword [rbp + 0x138]
mov rax, qword [rbp + 0x130]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x28], rax
call fcn.00817fd0
jmp 0x85197e
lea rcx, [rbp + 0x120]
lea rdx, [0x00853a84]
lea r8, [0x008538dc]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x118]
lea rdx, [0x00853a84]
lea r8, [0x00853924]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x110]
lea rdx, [0x00853a0c]
lea r8, [0x00853a28]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x108]
lea rdx, [0x00853a0c]
lea r8, [0x00853a3c]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0x100]
lea rdx, [0x00853a0c]
lea r8, [0x00853a54]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0x558]
lea r8, [0x00853a68]
call fcn.00410bc0
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x110]
mov r9, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rax
call fcn.00817fd0
lea rcx, [rbp + 0xe8]
lea rdx, [0x00853a84]
lea r8, [0x008538dc]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xe0]
lea rdx, [0x00853a84]
lea r8, [0x00853924]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xd8]
lea rdx, [0x00853a0c]
lea r8, [0x00853a28]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xd0]
lea rdx, [0x00853a0c]
lea r8, [0x00853a3c]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xc8]
lea rdx, [0x00853a0c]
lea r8, [0x00853a54]
mov r9, qword [rbp + 0x550]
mov byte [rsp + 0x20], 0
call fcn.006fd210
lea rcx, [rbp + 0xf0]
mov edx, 0xd
lea r8, [0x00853aa8]
mov r9, qword [rbp + 0xe8]
lea rax, [0x00853904]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xe0]
mov qword [rsp + 0x28], rax
lea rax, [0x00853b1c]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xd8]
mov qword [rsp + 0x38], rax
lea rax, [0x00853b38]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [0x00853b58]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0xc8]
mov qword [rsp + 0x58], rax
lea rax, [0x0085393c]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x558]
mov qword [rsp + 0x68], rax
lea rax, [0x00853a68]
mov qword [rsp + 0x70], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0xf0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
xor r8, r8
call fcn.006f83a0
jmp 0x851b5f
lea rcx, [rbp + 0xb8]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0xc0]
mov edx, 4
lea r8, [0x00853b74]
mov r9, qword [rbp + 0xb8]
lea rax, [0x0085309c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x560]
mov qword [rsp + 0x28], rax
call fcn.00410ce0
mov rcx, qword [rbp + 0xc0]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
lea rcx, [rbp + 0xb0]
lea rdx, [0x00852584]
call fcn.00442e40
lea rcx, [rbp + 0xb0]
lea rdx, [0x00853be8]
call fcn.00410ad0
mov rcx, qword [rbp + 0xb0]
call fcn.006f9e40
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 5
jle 0x851cf3
mov rax, qword [0x008c93a8]
mov rax, qword [rax]
mov rcx, rax
lea rdx, [rbp + 0xa8]
lea r8, [0x00851eb8]
lea r9, [0x00853c0c]
mov qword [rsp + 0x20], 0
mov rbx, qword [rax]
call qword [rbx + 8]
mov rcx, qword [rbp + 0xa8]
lea rdx, [0x00851ef8]
call fcn.00410dc0
test eax, eax
jne 0x851cf3
lea rcx, [0x00853c2c]
mov rax, qword [0x008c8890]
mov rdx, qword [rax]
mov r8b, 1
call fcn.006f83a0
mov rax, qword [0x008c97c8]
cmp dword [rax + 8], 6
jge 0x851c1e
call fcn.007e52d0
jmp 0x851cf3
lea rcx, [rbp + 0xa0]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0xa0]
lea rdx, [0x00852c28]
call fcn.00410dc0
test eax, eax
jne 0x851c56
call fcn.007e52d0
jmp 0x851cf3
lea rcx, [rbp + 0x98]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0x98]
lea rdx, [0x00853c7c]
call fcn.00410dc0
test eax, eax
jne 0x851c8b
call fcn.007e7d70
jmp 0x851cf3
lea rcx, [rbp + 0x90]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0x90]
lea rdx, [0x00853c94]
call fcn.00410dc0
test eax, eax
jne 0x851cc0
call fcn.007e7d70
jmp 0x851cf3
lea rcx, [rbp + 0x88]
mov rax, qword [0x008c97c8]
mov rdx, qword [rax + 0x10]
call fcn.006fb5c0
mov rcx, qword [rbp + 0x88]
lea rdx, [0x00853cb0]
call fcn.00410dc0
test eax, eax
jne 0x851cf3
call fcn.007e7d70
mov rcx, 0xffffffff80000002
lea rdx, [0x00853cc8]
mov r8d, 0xf003f
call fcn.006f6d50
nop
lea rcx, [rbp + 0x88]
mov edx, 0x5a
call fcn.0040f030
lea rcx, [rbp + 0x358]
mov rdx, qword [0x00849cc8]
mov r8d, 2
call fcn.00411620
lea rcx, [rbp + 0x3b8]
mov edx, 8
call fcn.0040f030
lea rcx, [rbp + 0x3f8]
mov edx, 0x26
call fcn.0040f030
lea rcx, [rbp + 0x550]
mov edx, 8
call fcn.0040f030
movzx rax, byte [rbp + 0x5af]
lea rsp, [rbp + 0x5b8]
pop rbx
pop rsi
pop rdi
pop rbp
ret