Function at 0x4746b8
Capabilities:
Get common file path
Get startup folder
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x4746c0
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4756ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004047a0
xor eax, eax
mov al, bl
cmp eax, 0x36
ja case.0x4746f0.0
jmp dword [eax*4 + 0x4746f7]
xor eax, eax
push ebp
push 0x47486e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x474805
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x47480f
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x4756e0
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x474858
mov edx, 0x475714
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x474850
lea ecx, [ebp - 0x10]
mov edx, 0x475714
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x474910
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x4748a7
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x4748b1
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x4756e0
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x4748fa
mov edx, 0x47572c
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x4748f2
lea ecx, [ebp - 0x10]
mov edx, 0x47572c
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x14
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 5
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x114]
mov al, 3
call fcn.004746b8
mov eax, dword [ebp - 0x114]
mov ecx, 2
mov edx, 1
call fcn.00404cc0
jmp case.0x4746f0.0
lea edx, [ebp - 0x118]
mov eax, dword [0x483af4]
mov eax, dword [eax]
call fcn.0046be38
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x10]
call fcn.004095c8
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x36c]
call fcn.0044bcd8
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 9
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 6
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x1f
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x15
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x1a
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
xor eax, eax
push ebp
push 0x474c70
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x474be4
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x474bee
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x475744
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x474c5a
mov edx, 0x475790
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x474c31
lea ecx, [ebp - 0x10]
mov edx, 0x475790
mov eax, dword [ebp - 8]
call fcn.004342ec
jmp 0x474c52
mov edx, 0x4757a8
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x474c52
lea ecx, [ebp - 0x10]
mov edx, 0x4757a8
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x11c]
mov al, 0x12
call fcn.004746b8
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x10]
call fcn.004095c8
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0xb
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 2
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 7
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x19
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x16
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x17
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x18
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
push 1
mov ecx, 0x4757c0
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx + 8]
dec eax
jne 0x474efe
lea edx, [ebp - 0x120]
mov al, 0x18
call fcn.004746b8
push dword [ebp - 0x120]
push 0x4757e4
lea edx, [ebp - 0x124]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3f0]
call fcn.0044bcd8
push dword [ebp - 0x124]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b20
jmp case.0x4746f0.0
lea edx, [ebp - 0x128]
mov al, 0x14
call fcn.004746b8
push dword [ebp - 0x128]
push 0x4757e4
lea edx, [ebp - 0x12c]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3f0]
call fcn.0044bcd8
push dword [ebp - 0x12c]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b20
jmp case.0x4746f0.0
xor eax, eax
push ebp
push 0x47500b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x474f76
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x474f80
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x475744
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x474ff5
mov edx, 0x4757f0
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x474fed
lea ecx, [ebp - 0x10]
mov edx, 0x4757f0
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 0x10]
call fcn.00404a60
mov edx, dword [ebp - 0x10]
cmp byte [edx + eax - 1], 0x5c
je 0x474fe0
lea eax, [ebp - 0x10]
mov edx, 0x4757e4
call fcn.00404a68
lea eax, [ebp - 0x10]
mov edx, 0x475800
call fcn.00404a68
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x475834
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x475844
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x475858
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x47586c
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x47587c
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3bc]
call fcn.0044bcd8
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3c4]
call fcn.0044bcd8
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3ac]
call fcn.0044bcd8
jmp case.0x4746f0.0
call fcn.0040ab20
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x10]
call fcn.0040b734
jmp case.0x4746f0.0
lea eax, [ebp - 0xc]
push eax
push 0x1c
mov eax, dword [0x485d00]
call fcn.004524f8
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne case.0x4746f0.0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
xor eax, eax
push ebp
push 0x4751e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x47517c
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475186
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x475890
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x4751cf
mov edx, 0x4758dc
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x4751c7
lea ecx, [ebp - 0x10]
mov edx, 0x4758dc
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475287
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x47521e
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475228
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x475890
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x475271
mov edx, 0x4758f4
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x475269
lea ecx, [ebp - 0x10]
mov edx, 0x4758f4
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475329
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x4752c0
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x4752ca
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x475890
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x475313
mov edx, 0x475910
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x47530b
lea ecx, [ebp - 0x10]
mov edx, 0x475910
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x130]
mov al, 0x16
call fcn.004746b8
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x10]
call fcn.004095c8
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x3cc]
call fcn.0044bcd8
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x39c]
call fcn.0044bcd8
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x47592c
mov edx, 0x475938
mov eax, dword [0x484cac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x475948
mov edx, 0x475938
mov eax, dword [0x484cac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
lea eax, [ebp - 0x10]
mov edx, dword [0x484cc4]
call fcn.00404838
jmp case.0x4746f0.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
lea edx, [ebp - 0x10]
call fcn.00408da8
jmp case.0x4746f0.0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x475954
mov edx, 0x4757d4
mov eax, dword [0x484ca8]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x4746f0.0
lea edx, [ebp - 0x10]
mov eax, dword [0x483af4]
mov eax, dword [eax]
call fcn.0046be38
jmp case.0x4746f0.0
xor eax, eax
push ebp
push 0x4754d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x4756e0
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x4754ba
mov edx, 0x475714
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x47547e
lea ecx, [ebp - 0x10]
mov edx, 0x475714
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
mov edx, dword [ebp - 0x10]
mov eax, 0x475968
call fcn.00404da4
test eax, eax
jle 0x4754ba
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x475968
call fcn.00404da4
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x134]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x36c]
call fcn.0044bcd8
cmp dword [ebp - 0x134], 0
je 0x47554d
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x138]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x36c]
call fcn.0044bcd8
mov edx, dword [ebp - 0x138]
mov eax, 0x4757e4
call fcn.00404da4
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [0x485d00]
mov eax, dword [eax + 0x36c]
call fcn.0044bcd8
mov eax, dword [ebp - 0x13c]
mov edx, 1
pop ecx
call fcn.00404cc0
jmp case.0x4746f0.0
lea eax, [ebp - 0x10]
mov edx, 0x475978
call fcn.00404838
jmp case.0x4746f0.0
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.004099c0
jmp case.0x4746f0.0
xor eax, eax
push ebp
push 0x475630
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433dc4]
call fcn.00433ec4
mov dword [ebp - 8], eax
cmp byte [0x484cc0], 1
jne 0x4755b5
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x4755bf
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00433f64
xor ecx, ecx
mov edx, 0x4756e0
mov eax, dword [ebp - 8]
call fcn.00433fc8
test al, al
je 0x47561a
mov edx, 0x475984
mov eax, dword [ebp - 8]
call fcn.004344a4
test al, al
je 0x475602
lea ecx, [ebp - 0x10]
mov edx, 0x475984
mov eax, dword [ebp - 8]
call fcn.004342ec
jmp 0x475612
lea ecx, [ebp - 0x10]
mov edx, 0x475714
mov eax, dword [ebp - 8]
call fcn.004342ec
mov eax, dword [ebp - 8]
call fcn.00433f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4746f0.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x140]
mov al, 0x11
call fcn.004746b8
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x10]
call fcn.0040961c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0040d688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4756d1
lea eax, [ebp - 0x140]
call fcn.004047a0
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.004047c4
lea eax, [ebp - 0x130]
call fcn.004047a0
lea eax, [ebp - 0x12c]
call fcn.004047a0
lea eax, [ebp - 0x128]
call fcn.004047a0
lea eax, [ebp - 0x124]
call fcn.004047a0
lea eax, [ebp - 0x120]
mov edx, 4
call fcn.004047c4
lea eax, [ebp - 0x10]
call fcn.004047a0
ret