Function at 0x474f08
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x474f10
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475df9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004047a0
mov eax, dword [ebp - 4]
call fcn.004047a0
xor eax, eax
mov al, bl
cmp eax, 0x3e
ja case.0x474f49.0
jmp dword [eax*4 + 0x474f50]
xor eax, eax
push ebp
push 0x4750e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x47507e
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475088
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e10
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x4750d1
mov edx, 0x475e44
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x4750c9
lea ecx, [ebp - 0xc]
mov edx, 0x475e44
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475189
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475120
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x47512a
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e10
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475173
mov edx, 0x475e5c
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x47516b
lea ecx, [ebp - 0xc]
mov edx, 0x475e5c
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
push 0xff
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004099e0
jmp case.0x474f49.0
push 0xff
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004099e0
jmp case.0x474f49.0
lea eax, [ebp - 0x111]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004099e0
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x14
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 5
call fcn.00474ec4
jmp case.0x474f49.0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x118]
mov al, 3
call fcn.00474f08
mov eax, dword [ebp - 0x118]
mov ecx, 2
mov edx, 1
call fcn.00404cc0
jmp case.0x474f49.0
lea edx, [ebp - 0x11c]
mov eax, dword [0x48bc54]
mov eax, dword [eax]
call fcn.0046c3bc
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0xc]
call fcn.004095e8
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x36c]
call fcn.0044c25c
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 9
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 6
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x1f
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x15
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x1a
call fcn.00474ec4
jmp case.0x474f49.0
xor eax, eax
push ebp
push 0x4753a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475314
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x47531e
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e74
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x47538a
mov edx, 0x475ec0
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475361
lea ecx, [ebp - 0xc]
mov edx, 0x475ec0
mov eax, dword [ebp - 8]
call fcn.00434694
jmp 0x475382
mov edx, 0x475ed8
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475382
lea ecx, [ebp - 0xc]
mov edx, 0x475ed8
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x120]
mov al, 0x12
call fcn.00474f08
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0xc]
call fcn.004095e8
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0xb
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 7
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x19
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x16
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x17
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x18
call fcn.00474ec4
jmp case.0x474f49.0
cmp byte [0x48ccec], 0
je 0x4754a3
lea edx, [ebp - 0x124]
mov al, 0x14
call fcn.00474f08
push dword [ebp - 0x124]
push 0x475ef0
lea edx, [ebp - 0x128]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3f0]
call fcn.0044c25c
push dword [ebp - 0x128]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b20
jmp case.0x474f49.0
lea edx, [ebp - 0x12c]
mov al, 0x18
call fcn.00474f08
push dword [ebp - 0x12c]
push 0x475ef0
lea edx, [ebp - 0x130]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3f0]
call fcn.0044c25c
push dword [ebp - 0x130]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b20
jmp case.0x474f49.0
lea edx, [ebp - 0x134]
mov al, 0xf
call fcn.00474f08
mov edx, dword [ebp - 0x134]
lea eax, [ebp - 0xc]
mov ecx, 0x475efc
call fcn.00404aac
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x475f30
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x475f50
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x475f64
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x475f78
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x475f88
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3bc]
call fcn.0044c25c
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3c4]
call fcn.0044c25c
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3ac]
call fcn.0044c25c
jmp case.0x474f49.0
call fcn.0040ab40
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xc]
call fcn.0040b7a4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x1c
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, 0x23
call fcn.00474ec4
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov al, 0x3c
call fcn.00474f08
jmp case.0x474f49.0
xor eax, eax
push ebp
push 0x4756d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x47566a
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475674
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475f9c
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x4756bd
mov edx, 0x475fe8
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x4756b5
lea ecx, [ebp - 0xc]
mov edx, 0x475fe8
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x138]
mov al, 0x16
call fcn.00474f08
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0xc]
call fcn.004095e8
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x3cc]
call fcn.0044c25c
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x39c]
call fcn.0044c25c
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x476004
mov edx, 0x476010
mov eax, dword [0x48ccb0]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x476020
mov edx, 0x476010
mov eax, dword [0x48ccb0]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
lea eax, [ebp - 0xc]
mov edx, dword [0x48ccc8]
call fcn.00404838
jmp case.0x474f49.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
lea edx, [ebp - 0xc]
call fcn.00408dc8
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x47602c
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
lea edx, [ebp - 0xc]
mov eax, dword [0x48bc54]
mov eax, dword [eax]
call fcn.0046c3bc
jmp case.0x474f49.0
xor eax, eax
push ebp
push 0x47586d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x4757f2
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x4757fc
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e10
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475857
mov edx, 0x476040
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x47583f
lea ecx, [ebp - 0xc]
mov edx, 0x476040
mov eax, dword [ebp - 8]
call fcn.00434694
jmp 0x47584f
lea ecx, [ebp - 0xc]
mov edx, 0x475e44
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x13c]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x36c]
call fcn.0044c25c
cmp dword [ebp - 0x13c], 0
je 0x4758ea
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x36c]
call fcn.0044c25c
mov edx, dword [ebp - 0x140]
mov eax, 0x475ef0
call fcn.00404da4
push eax
lea edx, [ebp - 0x144]
mov eax, dword [0x48cd1c]
mov eax, dword [eax + 0x36c]
call fcn.0044c25c
mov eax, dword [ebp - 0x144]
mov edx, 1
pop ecx
call fcn.00404cc0
jmp case.0x474f49.0
lea eax, [ebp - 0xc]
mov edx, 0x476058
call fcn.00404838
jmp case.0x474f49.0
push 0xff
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004099e0
jmp case.0x474f49.0
xor eax, eax
push ebp
push 0x4759cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475952
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x47595c
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e10
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x4759b7
mov edx, 0x476064
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x47599f
lea ecx, [ebp - 0xc]
mov edx, 0x476064
mov eax, dword [ebp - 8]
call fcn.00434694
jmp 0x4759af
lea ecx, [ebp - 0xc]
mov edx, 0x475e44
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
lea edx, [ebp - 0x148]
mov al, 0x11
call fcn.00474f08
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0xc]
call fcn.0040963c
jmp case.0x474f49.0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x476084
mov edx, 0x475f40
mov eax, dword [0x48ccac]
mov ebx, dword [eax]
call dword [ebx]
jmp case.0x474f49.0
xor eax, eax
push ebp
push 0x475aad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475a44
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475a4e
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e74
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475a97
mov edx, 0x476094
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475a8f
lea ecx, [ebp - 0xc]
mov edx, 0x476094
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475b4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475ae6
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475af0
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475e74
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475b39
mov edx, 0x4760a8
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475b31
lea ecx, [ebp - 0xc]
mov edx, 0x4760a8
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475bf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475b88
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475b92
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475f9c
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475bdb
mov edx, 0x4760bc
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475bd3
lea ecx, [ebp - 0xc]
mov edx, 0x4760bc
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475c93
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 1
jne 0x475c2a
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475c34
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475f9c
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475c7d
mov edx, 0x4760d4
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475c75
lea ecx, [ebp - 0xc]
mov edx, 0x4760d4
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
xor eax, eax
push ebp
push 0x475d35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x433e4c]
call fcn.00433fb8
mov dword [ebp - 8], eax
cmp byte [0x48ccc4], 0
je 0x475ccc
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20119
jmp 0x475cd6
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00434094
xor ecx, ecx
mov edx, 0x475f9c
mov eax, dword [ebp - 8]
call fcn.004341d8
test al, al
je 0x475d1f
mov edx, 0x4760e8
mov eax, dword [ebp - 8]
call fcn.0043484c
test al, al
je 0x475d17
lea ecx, [ebp - 0xc]
mov edx, 0x4760e8
mov eax, dword [ebp - 8]
call fcn.00434694
mov eax, dword [ebp - 8]
call fcn.00434064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x474f49.0
mov eax, dword [ebp - 8]
call fcn.00403a50
ret
call fcn.0040ab40
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc]
mov eax, 0x476104
call fcn.0040b7e8
jmp case.0x474f49.0
lea edx, [ebp - 0x14c]
mov eax, dword [0x48bc54]
mov eax, dword [eax]
call fcn.0046c3bc
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0xc]
call fcn.0040963c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0040d6f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475e00
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.004047c4
lea eax, [ebp - 0x144]
mov edx, 3
call fcn.004047c4
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004047c4
lea eax, [ebp - 0x130]
call fcn.004047a0
lea eax, [ebp - 0x12c]
call fcn.004047a0
lea eax, [ebp - 0x128]
call fcn.004047a0
lea eax, [ebp - 0x124]
mov edx, 4
call fcn.004047c4
lea eax, [ebp - 0xc]
call fcn.004047a0
ret